SUSE: 2016:0624-1 Important: OpenSSL DROWN DoS Fixes and Updates
suse
March 1, 2016
An update that solves 7 vulnerabilities and has two fixes An update that solves 7 vulnerabilities and has two fixes An update that solves 7 vulnerabilities and has two fixes is now...
Summary
This update for openssl fixes various security issues and bugs: Security issues fixed: - CVE-2016-0800 aka the "DROWN" attack (bsc#968046): OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. This update changes the openssl library to: * Disable SSLv2 protocol support by default. This can be overridden by setting the environment variable "OPENSSL_ALLOW_SSL2" or by using SSL_CTX_clear_options using the SSL_OP_NO_SSLv2 flag. Note that various services and clients had already disabled SSL protocol 2 by default previously. * Disable all weak EXPORT ciphers by default. These can be reenabled if required by old legacy software using the environment variable
Topics Covered
References
#952871 #963415 #967787 #968046 #968047 #968048
#968051 #968053 #968374
Cross- CVE-2015-3197 CVE-2016-0702 CVE-2016-0703
CVE-2016-0705 CVE-2016-0797 CVE-2016-0799
CVE-2016-0800
Affected Products:
SUSE Studio Onsite 1.3
SUSE Linux Enterprise Software Development Kit 11-SP4
SUSE Linux Enterprise Server 11-SP4
SUSE Linux Enterprise Server 11-SP3-LTSS
SUSE Linux Enterprise Server 11-SP2-LTSS
SUSE Linux Enterprise Desktop 11-SP4
SUSE Linux Enterprise Debuginfo 11-SP4
SUSE Linux Enterprise Debuginfo 11-SP3
SUSE Linux Enterprise Debuginfo 11-SP2
https://www.suse.com/security/cve/CVE-2015-3197.html
https://www.suse.com/security/cve/CVE-2016-0702.html
https://www.suse.com/security/cve/CVE-2016-0703.html
https://www.suse.com/security/cve/CVE-2016-070...
Read the Full Advisory
PREVIOUS
NEXT
Severity
important
Lowest
Low
Medium
High
Critical
Announcement ID: SUSE-SU-2016:0624-1
Rating: important
Topics Covered
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!