Rapid7 VulnDB

RHSA-2015:1072: openssl security update

Back to Search

RHSA-2015:1072: openssl security update

Severity
4
CVSS
(AV:N/AC:M/Au:N/C:N/I:P/A:N)
Published
05/20/2015
Created
07/25/2018
Added
06/08/2015
Modified
10/30/2017

Description

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3)and Transport Layer Security (TLS v1) protocols, as well as afull-strength, general purpose cryptography library.A flaw was found in the way the TLS protocol composes the Diffie-Hellman(DH) key exchange. A man-in-the-middle attacker could use this flaw toforce the use of weak 512 bit export-grade keys during the key exchange,allowing them do decrypt all traffic. (CVE-2015-4000)Note: This update forces the TLS/SSL client implementation in OpenSSL toreject DH key sizes below 768 bits, which prevents sessions to bedowngraded to export-grade keys. Future updates may raise this limit to1024 bits.All openssl users are advised to upgrade to these updated packages, whichcontain a backported patch to correct this issue. For the update to takeeffect, all services linked to the OpenSSL library must be restarted, orthe system rebooted.

Solution(s)

  • redhat-upgrade-openssl
  • redhat-upgrade-openssl-debuginfo
  • redhat-upgrade-openssl-devel
  • redhat-upgrade-openssl-libs
  • redhat-upgrade-openssl-perl
  • redhat-upgrade-openssl-static

References

  • redhat-upgrade-openssl
  • redhat-upgrade-openssl-debuginfo
  • redhat-upgrade-openssl-devel
  • redhat-upgrade-openssl-libs
  • redhat-upgrade-openssl-perl
  • redhat-upgrade-openssl-static

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;