Hi Larry,

Good call.

The most recent announcements seem to be for the EUS (extended update 
support) for the upstream product.

Looks like somehow I sent those off rather than archiving them.

Sorry for the confusion.  I probably shouldn't multi-task quite so much....

Pat

On 06/11/2014 12:56 PM, P. Larry Nelson wrote:
> Pat,
>
> I am now thoroughly confused.
> Two erratas just arrived for openssl - both with the same CVE numbers,
> but different Advisory ID's, *and* with different versions of openssl.
> (see referenced emails below).
>
> I just checked my SL5.x systems and they are showing
> openssl-0.9.8e-27.el5_10.3.i686 updated 6/5/14, the same version
> your showing in the 2nd email (2nd email below).
>
> I checked my SL6.x systems and they are showing
> openssl-1.0.1e-16.el6_5.14.x86_64, a *later* version than what
> your showing in the first email (1st email below)
>
> Thanks!
> - Larry
>
> Pat Riehecky wrote on 6/11/2014 10:32 AM:> Synopsis: Important: 
> openssl security update
> > Advisory ID:       SLSA-2014:0627-1
> > Issue Date:        2014-06-05
> > CVE Numbers:       CVE-2014-0224
> > --
> >
> > It was found that OpenSSL clients and servers could be forced, via a
> > specially crafted handshake packet, to use weak keying material for
> > communication. A man-in-the-middle attacker could use this flaw to 
> decrypt
> > and modify traffic between a client and a server. (CVE-2014-0224)
> >
> > Note: In order to exploit this flaw, both the server and the client 
> must
> > be using a vulnerable version of OpenSSL; the server must be using 
> OpenSSL
> > version 1.0.1 and above, and the client must be using any version of
> > OpenSSL. For more information about this flaw, refer to:
> >
> > For the update to take effect, all services linked to the OpenSSL 
> library
> > (such as httpd and other SSL-enabled services) must be restarted or the
> > system rebooted.
> > --
> >
> > SL5
> >    x86_64
> >      openssl-0.9.8e-12.el5_6.12.i686.rpm
> >      openssl-0.9.8e-12.el5_6.12.x86_64.rpm
> >      openssl-debuginfo-0.9.8e-12.el5_6.12.i386.rpm
> >      openssl-debuginfo-0.9.8e-12.el5_6.12.i686.rpm
> >      openssl-debuginfo-0.9.8e-12.el5_6.12.x86_64.rpm
> >      openssl-devel-0.9.8e-12.el5_6.12.i386.rpm
> >      openssl-devel-0.9.8e-12.el5_6.12.x86_64.rpm
> >      openssl-perl-0.9.8e-12.el5_6.12.x86_64.rpm
> >      openssl-0.9.8e-26.el5_9.4.i686.rpm
> >      openssl-0.9.8e-26.el5_9.4.x86_64.rpm
> >      openssl-debuginfo-0.9.8e-26.el5_9.4.i386.rpm
> >      openssl-debuginfo-0.9.8e-26.el5_9.4.i686.rpm
> >      openssl-debuginfo-0.9.8e-26.el5_9.4.x86_64.rpm
> >      openssl-devel-0.9.8e-26.el5_9.4.i386.rpm
> >      openssl-devel-0.9.8e-26.el5_9.4.x86_64.rpm
> >      openssl-perl-0.9.8e-26.el5_9.4.x86_64.rpm
> >    i386
> >      openssl-0.9.8e-12.el5_6.12.i386.rpm
> >      openssl-0.9.8e-12.el5_6.12.i686.rpm
> >      openssl-debuginfo-0.9.8e-12.el5_6.12.i386.rpm
> >      openssl-debuginfo-0.9.8e-12.el5_6.12.i686.rpm
> >      openssl-devel-0.9.8e-12.el5_6.12.i386.rpm
> >      openssl-perl-0.9.8e-12.el5_6.12.i386.rpm
> >      openssl-0.9.8e-26.el5_9.4.i386.rpm
> >      openssl-0.9.8e-26.el5_9.4.i686.rpm
> >      openssl-debuginfo-0.9.8e-26.el5_9.4.i386.rpm
> >      openssl-debuginfo-0.9.8e-26.el5_9.4.i686.rpm
> >      openssl-devel-0.9.8e-26.el5_9.4.i386.rpm
> >      openssl-perl-0.9.8e-26.el5_9.4.i386.rpm
> > SL6
> >    x86_64
> >      openssl-1.0.0-25.el6_3.3.i686.rpm
> >      openssl-1.0.0-25.el6_3.3.x86_64.rpm
> >      openssl-debuginfo-1.0.0-25.el6_3.3.i686.rpm
> >      openssl-debuginfo-1.0.0-25.el6_3.3.x86_64.rpm
> >      openssl-1.0.0-27.el6_4.4.i686.rpm
> >      openssl-1.0.0-27.el6_4.4.x86_64.rpm
> >      openssl-debuginfo-1.0.0-27.el6_4.4.i686.rpm
> >      openssl-debuginfo-1.0.0-27.el6_4.4.x86_64.rpm
> >      openssl-devel-1.0.0-25.el6_3.3.i686.rpm
> >      openssl-devel-1.0.0-25.el6_3.3.x86_64.rpm
> >      openssl-perl-1.0.0-25.el6_3.3.x86_64.rpm
> >      openssl-static-1.0.0-25.el6_3.3.x86_64.rpm
> >      openssl-devel-1.0.0-27.el6_4.4.i686.rpm
> >      openssl-devel-1.0.0-27.el6_4.4.x86_64.rpm
> >      openssl-perl-1.0.0-27.el6_4.4.x86_64.rpm
> >      openssl-static-1.0.0-27.el6_4.4.x86_64.rpm
> >    i386
> >      openssl-1.0.0-25.el6_3.3.i686.rpm
> >      openssl-debuginfo-1.0.0-25.el6_3.3.i686.rpm
> >      openssl-devel-1.0.0-25.el6_3.3.i686.rpm
> >      openssl-1.0.0-27.el6_4.4.i686.rpm
> >      openssl-debuginfo-1.0.0-27.el6_4.4.i686.rpm
> >      openssl-devel-1.0.0-27.el6_4.4.i686.rpm
> >      openssl-perl-1.0.0-25.el6_3.3.i686.rpm
> >      openssl-static-1.0.0-25.el6_3.3.i686.rpm
> >      openssl-perl-1.0.0-27.el6_4.4.i686.rpm
> >      openssl-static-1.0.0-27.el6_4.4.i686.rpm
> >
> > - Scientific Linux Development Team
> >
>
>
>
> Pat Riehecky wrote on 6/11/2014 10:33 AM:
>> Synopsis:          Important: openssl security update
>> Advisory ID:       SLSA-2014:0624-1
>> Issue Date:        2014-06-05
>> CVE Numbers:       CVE-2014-0224
>> -- 
>>
>> It was found that OpenSSL clients and servers could be forced, via a
>> specially crafted handshake packet, to use weak keying material for
>> communication. A man-in-the-middle attacker could use this flaw to 
>> decrypt
>> and modify traffic between a client and a server. (CVE-2014-0224)
>>
>> Note: In order to exploit this flaw, both the server and the client must
>> be using a vulnerable version of OpenSSL; the server must be using 
>> OpenSSL
>> version 1.0.1 and above, and the client must be using any version of
>> OpenSSL. For more information about this flaw, refer to:
>>
>> For the update to take effect, all services linked to the OpenSSL 
>> library
>> (such as httpd and other SSL-enabled services) must be restarted or the
>> system rebooted.
>> -- 
>>
>> SL5
>>    x86_64
>>      openssl-0.9.8e-27.el5_10.3.i686.rpm
>>      openssl-0.9.8e-27.el5_10.3.x86_64.rpm
>>      openssl-debuginfo-0.9.8e-27.el5_10.3.i686.rpm
>>      openssl-debuginfo-0.9.8e-27.el5_10.3.x86_64.rpm
>>      openssl-perl-0.9.8e-27.el5_10.3.x86_64.rpm
>>      openssl-debuginfo-0.9.8e-27.el5_10.3.i386.rpm
>>      openssl-devel-0.9.8e-27.el5_10.3.i386.rpm
>>      openssl-devel-0.9.8e-27.el5_10.3.x86_64.rpm
>>    i386
>>      openssl-0.9.8e-27.el5_10.3.i386.rpm
>>      openssl-0.9.8e-27.el5_10.3.i686.rpm
>>      openssl-debuginfo-0.9.8e-27.el5_10.3.i386.rpm
>>      openssl-debuginfo-0.9.8e-27.el5_10.3.i686.rpm
>>      openssl-perl-0.9.8e-27.el5_10.3.i386.rpm
>>      openssl-devel-0.9.8e-27.el5_10.3.i386.rpm
>>
>> - Scientific Linux Development Team
>>
>
>


-- 
Pat Riehecky

Scientific Linux developer
http://www.scientificlinux.org/