Red Hat Security Advisory: openssl security update

Fixed packages 8

Vulnerabilities 5

• Unscored —
  CVE-2015-0293 EPSS 21%

  The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a a…

  openssl openssl Debian Ubuntu
  Mar 19, 2015
• Unscored —
  CVE-2015-3197 Public exploit EPSS 11%

  ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which ma…

  openssl Debian
  Feb 15, 2016
• Unscored —
  CVE-2016-0703

  The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0…

  openssl Debian
  Mar 2, 2016
• Unscored —
  CVE-2016-0704

  An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSS…

  openssl Debian
  Mar 2, 2016
• Unscored —
  CVE-2016-0800 Public exploit EPSS 82%

  The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to s…

  openssl nss Debian
  Mar 1, 2016

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/articles/2176731
• article
  https://drownattack.com/
• article
  https://openssl.org/news/secadv/20160128.txt
• article
  https://openssl.org/news/secadv/20160301.txt
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1202404
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1301846
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1310593
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1310811
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1310814
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0306.json
• report
  https://access.redhat.com/security/cve/CVE-2015-0293
• advisory
  https://www.cve.org/CVERecord?id=CVE-2015-0293
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2015-0293
• article
  https://access.redhat.com/articles/1384453
• article
  https://openssl.org/news/secadv_20150319.txt
• report
  https://access.redhat.com/security/cve/CVE-2015-3197
• advisory
  https://www.cve.org/CVERecord?id=CVE-2015-3197
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2015-3197
• article
  https://www.openssl.org/news/secadv/20160128.txt
• report
  https://access.redhat.com/security/cve/CVE-2016-0703
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-0703
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-0703
• article
  https://www.openssl.org/news/secadv/20160301.txt
• report
  https://access.redhat.com/security/cve/CVE-2016-0704
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-0704
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-0704
• report
  https://access.redhat.com/security/cve/CVE-2016-0800
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-0800
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-0800
• article
  https://www.drownattack.com/