Skip to content
OpenAdvisories
Medium ELSA-2017-0286 2 CVEs

Moderate: openssl security update (Oracle Linux 7)

Published Feb 20, 2017 · Updated Feb 20, 2017

Ecosystem: Oracle Linux

Summary

[1.0.1e-48.4]
- fix CVE-2017-3731 - DoS via truncated packets with RC4-MD5 cipher
- fix CVE-2016-8610 - DoS of single-threaded servers via excessive alerts

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 7 openssl 1:1.0.1e-60.el7_3.1
Oracle Linux · 7 openssl-devel 1:1.0.1e-60.el7_3.1
Oracle Linux · 7 openssl-libs 1:1.0.1e-60.el7_3.1
Oracle Linux · 7 openssl-perl 1:1.0.1e-60.el7_3.1
Oracle Linux · 7 openssl-static 1:1.0.1e-60.el7_3.1

Vulnerabilities 2

  • Unscored —
    CVE-2016-8610 Public exploit EPSS 40%

    A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL prot…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2017-3731 EPSS 57%

    Truncated packet could crash via OOB read

    If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be trigge…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine