Summary
[3.2.2-6.0.1.1]
- Enable openssl-fips-provider dependency [Orabug: 36504822]
- Temporary disable openssl-fips-provider dependency [Orabug: 36504822]
- Replace upstream references [Orabug: 34340177]
[1:3.2.2-6.1]
- RFC7250 handshakes with unauthenticated servers don't abort as expected (CVE-2024-12797)
Resolves: RHEL-76755
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | openssl | 1:3.2.2-6.0.1.el9_5.1 |
| Oracle Linux · 9 | openssl-devel | 1:3.2.2-6.0.1.el9_5.1 |
| Oracle Linux · 9 | openssl-libs | 1:3.2.2-6.0.1.el9_5.1 |
| Oracle Linux · 9 | openssl-perl | 1:3.2.2-6.0.1.el9_5.1 |
Vulnerabilities 1
-
High 7.4
RFC7250 handshakes with unauthenticated servers don't abort as expected
Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set. Impact summary: TLS an…