openssl-1.0.1e-51.el7.4

エラータID: AXSA:2016-120:02

Release date: 
Wednesday, March 2, 2016 - 00:11
Subject: 
openssl-1.0.1e-51.el7.4
Affected Channels: 
Asianux Server 7 for x86_64
Severity: 
High
Description: 

The OpenSSL toolkit provides support for secure communications between
machines. OpenSSL includes a certificate management tool and shared
libraries which provide various cryptographic algorithms and
protocols.

Security issues fixed with this release:

CVE-2015-3197
ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f
does not prevent use of disabled ciphers, which makes it easier for
man-in-the-middle attackers to defeat cryptographic protection
mechanisms by performing computations on SSLv2 traffic, related to the
get_client_master_key and get_client_hello functions.
CVE-2016-0702
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.
CVE-2016-0705
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.
CVE-2016-0797
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.
CVE-2016-0800
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.

Solution: 

Update packages.

CVEs: 
CVE-2015-3197
ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.
CVE-2016-0702
The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, aka a "CacheBleed" attack.
CVE-2016-0705
Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.
CVE-2016-0797
Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c.
CVE-2016-0800
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.
Additional Info: 

N/A

Download: 

SRPMS
  1. openssl-1.0.1e-51.el7.4.src.rpm
    MD5: d033048fae7a4519141f6a32647d9641
    SHA-256: 61188684f81b61660cc1ab9facb65e04eabfcec91b4d5cd3f496f25c7c3cddb3
    Size: 3.13 MB

Asianux Server 7 for x86_64
  1. openssl-1.0.1e-51.el7.4.x86_64.rpm
    MD5: 93637aecbfd9055b67541cb6f7a33ccb
    SHA-256: 73be165ddfe33d2fff97847778483fa1c4e93542b64d03da6472a119cce98b8a
    Size: 710.32 kB
  2. openssl-devel-1.0.1e-51.el7.4.x86_64.rpm
    MD5: 11fbc5054db402a76bd8d9e2279acc0c
    SHA-256: 58449d24a62fda4ff9d795bec9d856b0cec4c8f3ec8a6706098acccb66069dda
    Size: 1.18 MB
  3. openssl-libs-1.0.1e-51.el7.4.x86_64.rpm
    MD5: 204883aa7ddee4f44f5b1a4f8d377474
    SHA-256: 48ed526e19454d5c7ef7351f189250b077de471c51ac8374126b89c0a6be5e6a
    Size: 950.47 kB
  4. openssl-devel-1.0.1e-51.el7.4.i686.rpm
    MD5: ac757acdf1032843e1a3ba01fe998166
    SHA-256: 83b0d084b242a4c431563ec2ad6765805f4295fb77121968623215d23374acd2
    Size: 1.18 MB
  5. openssl-libs-1.0.1e-51.el7.4.i686.rpm
    MD5: 719a5feaf7470b29347357ba052a1e9f
    SHA-256: 733a630474def13734dfebd59d052761c614ac9dfa78789a65de8df25bf48c97
    Size: 937.03 kB