--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2015-11c5c57d59
2016-01-06 19:10:14.095960
--------------------------------------------------------------------------------
Name : openssl101e
Product : Fedora EPEL 5
Version : 1.0.1e
Release : 5.el5
URL :
http://www.openssl.org/
Summary : A general purpose cryptography library with TLS implementation
Description :
The OpenSSL toolkit provides support for secure communications between
machines. OpenSSL includes a certificate management tool and shared
libraries which provide various cryptographic algorithms and protocols.
--------------------------------------------------------------------------------
Update Information:
A NULL pointer derefernce flaw was found in the way OpenSSL verified signatures
using the RSA PSS algorithm. A remote attacked could possibly use this flaw to
crash a TLS/SSL client using OpenSSL, or a TLS/SSL server using OpenSSL if it
enabled client authentication. (CVE-2015-3194) A memory leak vulnerability was
found in the way OpenSSL parsed PKCS#7 and CMS data. A remote attacker could use
this flaw to cause an application that parses PKCS#7 or CMS data from untrusted
sources to use an excessive amount of memory and possibly crash. (CVE-2015-3195)
A race condition flaw, leading to a double free, was found in the way OpenSSL
handled pre-shared key (PSK) identify hints. A remote attacker could use this
flaw to crash a multi-threaded SSL/TLS client using OpenSSL. (CVE-2015-3196)
---- The OpenSSL toolkit provides support for secure communications between
machines. OpenSSL includes a certificate management tool and shared libraries
which provide various cryptographic algorithms and protocols.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1288326 - CVE-2015-3196 OpenSSL: Race condition handling PSK identify hint
https://bugzilla.redhat.com/show_bug.cgi?id=1288326
[ 2 ] Bug #1288322 - CVE-2015-3195 OpenSSL: X509_ATTRIBUTE memory leak
https://bugzilla.redhat.com/show_bug.cgi?id=1288322
[ 3 ] Bug #1288320 - CVE-2015-3194 OpenSSL: Certificate verify crash with missing PSS
parameter
https://bugzilla.redhat.com/show_bug.cgi?id=1288320
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update openssl101e' at the command line.
For more information, refer to "Managing Software with yum",
available at
https://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------