--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2017-90b2cbfdaf
2017-02-23 14:52:11.976976
--------------------------------------------------------------------------------
Name : openssl101e
Product : Fedora EPEL 5
Version : 1.0.1e
Release : 10.el5
URL :
http://www.openssl.org/
Summary : A general purpose cryptography library with TLS implementation
Description :
The OpenSSL toolkit provides support for secure communications between
machines. OpenSSL includes a certificate management tool and shared
libraries which provide various cryptographic algorithms and protocols.
--------------------------------------------------------------------------------
Update Information:
OpenSSL ======= Security Fixes -------------- * An integer underflow leading
to an out of bounds read flaw was found in OpenSSL. A remote attacker could
possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL
if it used the RC4-MD5 cipher suite. (CVE-2017-3731) * A denial of service
flaw was found in the way the TLS/SSL protocol defined processing of ALERT
packets during a connection handshake. A remote attacker could use this flaw to
make a TLS/SSL server consume an excessive amount of CPU and fail to accept
connections form other clients. (CVE-2016-8610) * The signing function in
crypto/ecdsa/ecdsa_ossl.c in certain OpenSSL versions and forks is vulnerable to
timing attacks when signing with the standardized elliptic curve P-256 despite
featuring constant-time curve operations and modular inversion. A software
defect omits setting the BN_FLG_CONSTTIME flag for nonces, failing to take a
secure code path in the BN_mod_inverse method and therefore resulting in a
cache-timing attack vulnerability. A malicious user with local access can
recover ECDSA P-256 private keys. (CVE-2016-7056)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1384743 - CVE-2016-8610 SSL/TLS: Malformed plain-text ALERT packets could
cause remote DoS
https://bugzilla.redhat.com/show_bug.cgi?id=1384743
[ 2 ] Bug #1416852 - CVE-2017-3731 openssl: Truncated packet could crash via OOB read
https://bugzilla.redhat.com/show_bug.cgi?id=1416852
[ 3 ] Bug #1412120 - CVE-2016-7056 openssl: ECDSA P-256 timing attack key recovery
https://bugzilla.redhat.com/show_bug.cgi?id=1412120
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update openssl101e' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/...
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------