Updated openssl packages that fix multiple security issues are nowavailable for Red Hat Storage 2.1.The Red Hat Security Response Team has rated this update as havingImportant security impact. Common Vulnerability Scoring System (CVSS) basescores, which give detailed severity ratings, are available for eachvulnerability from the CVE links in the References section.
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3)and Transport Layer Security (TLS v1) protocols, as well as afull-strength, general purpose cryptography library.It was found that OpenSSL clients and servers could be forced, via aspecially crafted handshake packet, to use weak keying material forcommunication. A man-in-the-middle attacker could use this flaw to decryptand modify traffic between a client and a server. (CVE-2014-0224)Note: In order to exploit this flaw, both the server and the client must beusing a vulnerable version of OpenSSL; the server must be using OpenSSLversion 1.0.1 and above, and the client must be using any version ofOpenSSL. For more information about this flaw, refer to:https://access.redhat.com/site/articles/904433A buffer overflow flaw was found in the way OpenSSL handled invalid DTLSpacket fragments. A remote attacker could possibly use this flaw to executearbitrary code on a DTLS client or server. (CVE-2014-0195)Multiple flaws were found in the way OpenSSL handled read and write bufferswhen the SSL_MODE_RELEASE_BUFFERS mode was enabled. A TLS/SSL client orserver using OpenSSL could crash or unexpectedly drop connections whenprocessing certain SSL traffic. (CVE-2010-5298, CVE-2014-0198)A denial of service flaw was found in the way OpenSSL handled certain DTLSServerHello requests. A specially crafted DTLS handshake packet could causea DTLS client using OpenSSL to crash. (CVE-2014-0221)A NULL pointer dereference flaw was found in the way OpenSSL performedanonymous Elliptic Curve Diffie Hellman (ECDH) key exchange. A speciallycrafted handshake packet could cause a TLS/SSL client that has theanonymous ECDH cipher suite enabled to crash. (CVE-2014-3470)Red Hat would like to thank the OpenSSL project for reporting these issues.Upstream acknowledges KIKUCHI Masashi of Lepidum as the original reporterof CVE-2014-0224, Jüri Aedla as the original reporter of CVE-2014-0195,Imre Rad of Search-Lab as the original reporter of CVE-2014-0221, and FelixGröbert and Ivan Fratrić of Google as the original reporters ofCVE-2014-3470.All OpenSSL users are advised to upgrade to these updated packages, whichcontain backported patches to correct these issues. For the update to takeeffect, all services linked to the OpenSSL library (such as httpd and otherSSL-enabled services) must be restarted or the system rebooted.
Before applying this update, make sure all previously released erratarelevant to your system have been applied.This update is available via the Red Hat Network. Details on how touse the Red Hat Network to apply this update are available athttps://access.redhat.com/site/articles/11258
1087195 – CVE-2010-5298 openssl: freelist misuse causing a possible use-after-free1093837 – CVE-2014-0198 openssl: SSL_MODE_RELEASE_BUFFERS NULL pointer dereference in do_ssl3_write()1103586 – CVE-2014-0224 openssl: SSL/TLS MITM vulnerability1103593 – CVE-2014-0221 openssl: DoS when sending invalid DTLS handshake1103598 – CVE-2014-0195 openssl: Buffer overflow via DTLS invalid fragment1103600 – CVE-2014-3470 openssl: client-side denial of service when using anonymous ECDH
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from: