OpenSSL CCS Injection Vulnerability (CVE-2014-0224) Alert
Red Hat was recently notified of a vulnerability affecting all versions of OpenSSL shipped with Red Hat products. CVE-2014-0224 could allow for a man-in-the-middle attack against an encrypted connection.
SSL/TLS connections typically allow for encrypted traffic to pass between two parties where only the intended senders and recipients can decrypt data. In the event of a man-in-the-middle attack, an attacker could intercept an encrypted data stream allowing them to decrypt, view and then manipulate said data.
The vulnerability can only be exploited if both server and client are vulnerable to this issue. In the event that one of the two is vulnerable, there is no risk of exploitation.
NOTE: This vulnerability cannot be used to extract server or client side key material. This means that existing signed certificates do not need replacement once software is updated.How does this impact systems
This issue affects products using OpenSSL.All versions prior to those listed as updates for this issue are vulnerable to some degree.
See the appropriate remediation article for specifics.
Products Affected:
| Product/Channel | Affecting | Fixed in package | Remediation details |
|---|---|---|---|
| Red Hat Enterprise Linux 7 | openssl-1.0.1e | openssl-1.0.1e-34.el7_0.3 | Red Hat Enterprise Linux |
| openssl098e | openssl098e-0.9.8e-29.el7_0.2 | ||
| Red Hat Enterprise Linux 6 | openssl-1.0.1e | openssl-1.0.1e-16.el6_5.14 | Red Hat Enterprise Linux |
| openssl098e | openssl098e-0.9.8e-18.el6_5.2 | ||
| openssl-1.0.0 | openssl-1.0.1e-16.el6_5.14 | ||
| Red Hat Storage 2.1 | openssl-1.0.1e | openssl-1.0.1e-16.el6_5.14 | Red Hat Storage 2.1 |
| Red Hat Enterprise Virtualization | openssl-1.0.1e | openssl-1.0.1e-16.el6_5.14 | Red Hat Enterprise Virtualization |
| Red Hat Enterprise Linux 5 | openssl-0.9.8e | openssl-0.9.8e-27.el5_10.3 | Red Hat Enterprise Linux |
| openssl-0.9.8b | openssl-0.9.8e-27.el5_10.3 | ||
| openssl097a | openssl097a-0.9.7a-12.el5_10.1 | ||
| Red Hat Enterprise Linux 4 Extended Lifecycle Support | openssl-0.9.7a | openssl-0.9.7a-43.22.el4 | Red Hat Enterprise Linux |
| Red Hat Enterprise Linux 5.6 Long Life | openssl-0.9.8e | openssl-0.9.8e-12.el5_6.12 | Red Hat Enterprise Linux |
| Red Hat Enterprise Linux 5.9 Extended Update Support | openssl-0.9.8e | openssl-0.9.8e-26.el5_9.4 | Red Hat Enterprise Linux |
| Red Hat Enterprise Linux 6.2 Advanced Update Support | openssl-1.0.0 | openssl-1.0.0-20.el6_2.7 | Red Hat Enterprise Linux |
| Red Hat Enterprise Linux 6.3 Extended Update Support | openssl-1.0.0 | openssl-1.0.0-25.el6_3.3 | Red Hat Enterprise Linux |
| Red Hat Enterprise Linux 6.4 Extended Update Support | openssl-1.0.0 | openssl-1.0.0-27.el6_4.4 | Red Hat Enterprise Linux |
| Red Hat JBoss Middleware products | JBoss EAP 5.2 | Red Hat JBoss Middleware | |
| JBoss EAP 6.2 CP03 / 6.2 CP03 | |||
| JBoss EWS 2.0.1 | |||
| JBoss EWP 5.2 |
Since any machine in the product classes listed above cannot determine whether a connection it makes as a client is to a vulnerable server the only prudent solution is to ensure that any machine running a vulnerable version is updated.
Frequently Asked Questions
This FAQ is for the vulnerability CVE-2014-0224 in OpenSSL, also known as "CCS Injection".Is this issue the same as HeartBleed?
No, this a new issue discovered in OpenSSL that could result in a man-in-the-middle attack. See the explanation above for full details.Is this issue worse than HeartBleed?
HeartBleed allowed anyone on the internet to exploit vulnerable servers. This issue requires an attacker to intercept and alter network traffic in real time in order to exploit the flaw. This reduces the risk that this vulnerability can be exploited but does not make it impossible, updating should be a primary remediation focus regardless of the difficulty in leveraging the exploit.Do I need to regenerate any certificates?
No, this issue does not result in certificate or private key information leaking.How can I tell if I'm vulnerable to this issue? Is it possible to test remotely for the presence of this issue?
All versions of OpenSSL are vulnerable to this issue. Review the relevant solution for your product: Red Hat Enterprise Linux Red Hat Enterprise Virtualization Red Hat JBoss Middleware Red Hat StorageRed Hat Access Labs has released the CCS Injection Detector to you validate your systems have been patched against this vulnerability.
How can I verify the update is working properly?
You can use the Access Labs CCS Injection Detector to verify the update has been applied successfully.