SUSE: 2016:0641-1 Important: OpenSSL Security Update for Critical Issues
suse
March 3, 2016
An update that fixes 7 vulnerabilities is now available
Summary
This update for compat-openssl098 fixes various security issues and bugs: Security issues fixed: - CVE-2016-0800 aka the "DROWN" attack (bsc#968046): OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. This update changes the openssl library to: * Disable SSLv2 protocol support by default. This can be overridden by setting the environment variable "OPENSSL_ALLOW_SSL2" or by using SSL_CTX_clear_options using the SSL_OP_NO_SSLv2 flag. Note that various services and clients had already disabled SSL protocol 2 by default previously. * Disable all weak EXPORT ciphers by default. These can be reenabled if required by old legacy software using the environment variable
Topics Covered
References
#952871 #963415 #968046 #968048 #968051 #968053
#968374
Cross- CVE-2015-3197 CVE-2016-0702 CVE-2016-0703
CVE-2016-0704 CVE-2016-0797 CVE-2016-0799
CVE-2016-0800
Affected Products:
SUSE Linux Enterprise Server for SAP 12-SP1
SUSE Linux Enterprise Module for Legacy Software 12
SUSE Linux Enterprise Desktop 12-SP1
SUSE Linux Enterprise Desktop 12
https://www.suse.com/security/cve/CVE-2015-3197.html
https://www.suse.com/security/cve/CVE-2016-0702.html
https://www.suse.com/security/cve/CVE-2016-0703.html
https://www.suse.com/security/cve/CVE-2016-0704.html
https://www.suse.com/security/cve/CVE-2016-0797.html
https://www.suse.com/security/cve/CVE-2016-0799.html
https://www.suse.com/security/cve/CVE-2016-0800.html
https://bugzilla.suse.com/952871
PREVIOUS
NEXT
Severity
important
Lowest
Low
Medium
High
Critical
Announcement ID: SUSE-SU-2016:0641-1
Rating: important
Topics Covered
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!