-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

Fedora, this morning, released the latest version of OpenSSL which fixes a MITM CCS injection attack (CVE-2014-0224). This vulnerability made a man-in-the-middle attack possible when both sides were using a vulnerable OpenSSL implementation. It is highly recommended that all users update their openssl packages (sudo yum update openssl) and verify that they have the openssl-1.0.1e-38 RPM installed. A restart of any service that is using OpenSSL is required for this fix to become active.

Additional information can be found on the Red Hat Security Blog[0] or the errata[1][2].

[0] https://securityblog.redhat.com/2014/06/05/openssl-mitm-ccs-injection-attack... [1] https://admin.fedoraproject.org/updates/openssl-1.0.1e-38.fc20 [2] https://admin.fedoraproject.org/updates/openssl-1.0.1e-38.fc19

- -- Eric

- -------------------------------------------------- Eric "Sparks" Christensen Fedora Project Security Team Red Hat Product Security

sparks@fedoraproject.org - sparks@redhat.com 097C 82C3 52DF C64A 50C2 E3A3 8076 ABDE 024B B3D1 - --------------------------------------------------