Skip to content
OpenAdvisories
High ELSA-2016-0372 5 CVEs

Important: openssl098e security update (Oracle Linux 7)

Published Mar 9, 2016 · Updated Mar 9, 2016

Ecosystem: Oracle Linux

Summary

[0.9.8e-20.0.1.1]
- Updated the description

[0.9.8e-20.1]
- fix CVE-2015-0293 - triggerable assert in SSLv2 server
- fix CVE-2015-3197 - SSLv2 ciphersuite enforcement
- disable SSLv2 in the generic TLS method

[0.9.8e-20]
- fix for CVE-2014-0224 - SSL/TLS MITM vulnerability

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 7 openssl098e 0:0.9.8e-29.el7_2.3

Vulnerabilities 5

  • Unscored —
    CVE-2015-0293 EPSS 21%

    The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a a…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2015-3197 Public exploit EPSS 11%

    ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which ma…

    openssl Debian
  • Unscored —
    CVE-2016-0703

    The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0…

    openssl Debian
  • Unscored —
    CVE-2016-0704

    An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSS…

    openssl Debian
  • Unscored —
    CVE-2016-0800 Public exploit EPSS 82%

    The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to s…

    openssl nss Debian