Content-Transfer-Encoding: |
7bit |
Sender: |
|
Subject: |
|
From: |
|
Date: |
Thu, 5 Jun 2014 14:47:39 +0000 |
MIME-Version: |
1.0 |
Content-Type: |
text/plain; charset="utf-8" |
Reply-To: |
|
Parts/Attachments: |
|
|
Synopsis: Important: openssl097a and openssl098e security update
Advisory ID: SLSA-2014:0626-1
Issue Date: 2014-06-05
CVE Numbers: CVE-2014-0224
--
It was found that OpenSSL clients and servers could be forced, via a
specially crafted handshake packet, to use weak keying material for
communication. A man-in-the-middle attacker could use this flaw to decrypt
and modify traffic between a client and a server. (CVE-2014-0224)
Note: In order to exploit this flaw, both the server and the client must
be using a vulnerable version of OpenSSL; the server must be using OpenSSL
version 1.0.1 and above, and the client must be using any version of
OpenSSL. For more information about this flaw, refer to:
For the update to take effect, all services linked to the OpenSSL library
(such as httpd and other SSL-enabled services) must be restarted or the
system rebooted.
--
SL5
x86_64
openssl097a-0.9.7a-12.el5_10.1.i386.rpm
openssl097a-0.9.7a-12.el5_10.1.x86_64.rpm
openssl097a-debuginfo-0.9.7a-12.el5_10.1.i386.rpm
openssl097a-debuginfo-0.9.7a-12.el5_10.1.x86_64.rpm
i386
openssl097a-0.9.7a-12.el5_10.1.i386.rpm
openssl097a-debuginfo-0.9.7a-12.el5_10.1.i386.rpm
SL6
x86_64
openssl098e-0.9.8e-18.el6_5.2.i686.rpm
openssl098e-0.9.8e-18.el6_5.2.x86_64.rpm
openssl098e-debuginfo-0.9.8e-18.el6_5.2.i686.rpm
openssl098e-debuginfo-0.9.8e-18.el6_5.2.x86_64.rpm
i386
openssl098e-0.9.8e-18.el6_5.2.i686.rpm
openssl098e-debuginfo-0.9.8e-18.el6_5.2.i686.rpm
- Scientific Linux Development Team
|
|
|