Skip to content
OpenAdvisories
Unscored RHSA-2019:2304 2 CVEs

Red Hat Security Advisory: openssl security and bug fix update

Published Sep 13, 2024 · Updated Sep 21, 2026

Ecosystem: Red Hat

Fixed packages 24

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client openssl 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::client openssl-debuginfo 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::client openssl-devel 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::client openssl-libs 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::client openssl-perl 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::client openssl-static 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode openssl 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode openssl-debuginfo 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode openssl-devel 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode openssl-libs 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode openssl-perl 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode openssl-static 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::server openssl 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::server openssl-debuginfo 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::server openssl-devel 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::server openssl-libs 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::server openssl-perl 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::server openssl-static 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation openssl 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation openssl-debuginfo 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation openssl-devel 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation openssl-libs 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation openssl-perl 1:1.0.2k-19.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation openssl-static 1:1.0.2k-19.el7

Vulnerabilities 2

  • Unscored —
    CVE-2018-0734 EPSS 12%

    Timing attack against DSA

    The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affec…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-1559 EPSS 17%

    0-byte record padding oracle

    If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1644364
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1649568
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1683804
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2304.json
  • report
    https://access.redhat.com/security/cve/CVE-2018-0734
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-0734
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-0734
  • report
    https://access.redhat.com/security/cve/CVE-2019-1559
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-1559
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-1559
  • article
    https://github.com/RUB-NDS/TLS-Padding-Oracles
  • article
    https://www.openssl.org/news/secadv/20190226.txt