Skip to content
OpenAdvisories
Medium ELSA-2015-0066 7 CVEs

Moderate: openssl security update (Oracle Linux 7)

Published Jan 20, 2015 · Updated Jan 20, 2015

Ecosystem: Oracle Linux

Summary

[1.0.1e-34.7]
- fix CVE-2014-3570 - incorrect computation in BN_sqr()
- fix CVE-2014-3571 - possible crash in dtls1_get_record()
- fix CVE-2014-3572 - possible downgrade of ECDH ciphersuite to non-PFS state
- fix CVE-2014-8275 - various certificate fingerprint issues
- fix CVE-2015-0204 - remove support for RSA ephemeral keys for non-export
ciphersuites and on server
- fix CVE-2015-0205 - do not allow unauthenticated client DH certificate
- fix CVE-2015-0206 - possible memory leak when buffering DTLS records

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 7 openssl 1:1.0.1e-34.el7_0.7
Oracle Linux · 7 openssl-devel 1:1.0.1e-34.el7_0.7
Oracle Linux · 7 openssl-libs 1:1.0.1e-34.el7_0.7
Oracle Linux · 7 openssl-perl 1:1.0.1e-34.el7_0.7
Oracle Linux · 7 openssl-static 1:1.0.1e-34.el7_0.7

Vulnerabilities 7

  • Unscored —
    CVE-2014-3570 Public exploit EPSS 22%

    The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly cal…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2014-3571 EPSS 22%

    OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of servi…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2014-3572

    The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2014-8275 Public exploit EPSS 15%

    OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificat…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2015-0204 Public exploit EPSS 99%

    The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2015-0205 Public exploit EPSS 22%

    The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client au…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2015-0206 EPSS 57%

    Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allo…

    openssl openssl Debian Ubuntu