Red Hat Security Advisory: openssl security update

Fixed packages 5

Vulnerabilities 6

• Unscored —
  CVE-2010-5298 EPSS 34%

  Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is …

  openssl openssl Debian Ubuntu
  Apr 14, 2014
• Unscored —
  CVE-2014-0195 Public exploit EPSS 100%

  The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.…

  openssl openssl openssl098 Debian Ubuntu
  Jun 5, 2014
• Unscored —
  CVE-2014-0198 EPSS 40%

  The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does no…

  openssl openssl Debian Ubuntu
  May 6, 2014
• Unscored —
  CVE-2014-0221 Public exploit EPSS 88%

  The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1…

  openssl openssl openssl098 Debian Ubuntu
  Jun 5, 2014
• Unscored —
  CVE-2014-0224 Public exploit EPSS 95%

  OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCip…

  openssl openssl openssl098 Debian Ubuntu
  Jun 5, 2014
• Unscored —
  CVE-2014-3470 EPSS 86%

  The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 befor…

  openssl openssl Debian Ubuntu
  Jun 5, 2014

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/site/articles/904433
• article
  https://access.redhat.com/site/solutions/906703
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1087195
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1093837
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1103586
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1103593
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1103598
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1103600
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0628.json
• report
  https://access.redhat.com/security/cve/CVE-2010-5298
• advisory
  https://www.cve.org/CVERecord?id=CVE-2010-5298
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2010-5298
• article
  https://www.openssl.org/news/secadv_20140605.txt
• report
  https://access.redhat.com/security/cve/CVE-2014-0195
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-0195
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-0195
• report
  https://access.redhat.com/security/cve/CVE-2014-0198
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-0198
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-0198
• report
  https://access.redhat.com/security/cve/CVE-2014-0221
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-0221
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-0221
• report
  https://access.redhat.com/security/cve/CVE-2014-0224
• article
  https://access.redhat.com/security/vulnerabilities/OpenSSL-CCS-Injection
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-0224
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-0224
• article
  https://access.redhat.com/site/solutions/905793
• report
  https://access.redhat.com/security/cve/CVE-2014-3470
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-3470
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-3470