Summary
[1.0.1e-42.8]
- improved fix for CVE-2015-1791
- add missing parts of CVE-2015-0209 fix for corectness although unexploitable
[1.0.1e-42.7]
- fix CVE-2014-8176 - invalid free in DTLS buffering code
- fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
- fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
- fix CVE-2015-1791 - race condition handling NewSessionTicket
- fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function
- fix CVE-2015-3216 - regression in RAND locking that can cause segfaults on
read in multithreaded applications
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | openssl | 1:1.0.1e-42.el7_1.8 |
| Oracle Linux · 7 | openssl-devel | 1:1.0.1e-42.el7_1.8 |
| Oracle Linux · 7 | openssl-libs | 1:1.0.1e-42.el7_1.8 |
| Oracle Linux · 7 | openssl-perl | 1:1.0.1e-42.el7_1.8 |
| Oracle Linux · 7 | openssl-static | 1:1.0.1e-42.el7_1.8 |
Vulnerabilities 6
-
Unscored —CVE-2014-8176 EPSS 17%
The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h…
-
Unscored —CVE-2015-1789 EPSS 76%
The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1…
-
Unscored —
The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.…
-
Unscored —
Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0…
-
Unscored —
The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n…
-
Unscored —
Race condition in a certain Red Hat patch to the PRNG lock implementation in the ssleay_rand_bytes function in OpenSSL,…