Issued:

2012-02-20

Updated:

2012-02-20

RHBA-2012:0229 - openssl bug fix and enhancement update

Synopsis

openssl bug fix and enhancement update

Type/Severity

Bug Fix Advisory (none)

Topic

Updated openssl packages that fix a bug and add various enhancements are now available for Red Hat Enterprise Linux 5.

Description

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

This update fixes the following bug:

• Prior to this update, the openssl configuration file variables with "yes" or "no" values were parsed incorrectly. The value of "yes" was interpreted as "no". With this update, the "yes" or "no" values in the configuration file are now parsed correctly. (BZ#726593)

In addition, this update provides the following enhancements:

• Documentation of possible error states related to the FIPS mode is now included in the README.FIPS file. (BZ#628976)

• DigiCert Certification Authority certificates were added to the /etc/pki/tls/certs/ca-bundle.crt file that contains the certificates of trusted certification authorities. (BZ#735819)

• Known answer self-tests for the SHA2 algorithms (SHA256 and SHA512) were added to the FIPS mode start up self tests. (BZ#740866)

• The makefile for generating keys and certificates was updated to generate the private keys with a length of 2048 bits by default as the previous length of 1024 bits is now considered too weak. (BZ#745410)

All users of OpenSSL should upgrade to these updated packages, which fix this bug and add these enhancements.

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at This content is not included.https://access.redhat.com/kb/docs/DOC-11259

Affected Products

Updated Packages

• openssl-0.9.8e-22.el5.s390x.rpm
• openssl-devel-0.9.8e-22.el5.ppc64.rpm
• openssl-devel-0.9.8e-22.el5.i386.rpm
• openssl-devel-0.9.8e-22.el5.s390.rpm
• openssl-devel-0.9.8e-22.el5.ppc.rpm
• openssl-0.9.8e-22.el5.i686.rpm
• openssl-perl-0.9.8e-22.el5.x86_64.rpm
• openssl-0.9.8e-22.el5.src.rpm
• openssl-devel-0.9.8e-22.el5.s390x.rpm
• openssl-0.9.8e-22.el5.s390.rpm
• openssl-perl-0.9.8e-22.el5.i386.rpm
• openssl-perl-0.9.8e-22.el5.s390x.rpm
• openssl-perl-0.9.8e-22.el5.ppc.rpm
• openssl-devel-0.9.8e-22.el5.x86_64.rpm
• openssl-0.9.8e-22.el5.x86_64.rpm
• openssl-0.9.8e-22.el5.ia64.rpm
• openssl-devel-0.9.8e-22.el5.ia64.rpm
• openssl-0.9.8e-22.el5.i386.rpm
• openssl-0.9.8e-22.el5.ppc64.rpm
• openssl-0.9.8e-22.el5.ppc.rpm
• openssl-perl-0.9.8e-22.el5.ia64.rpm

Fixes

• This content is not included.BZ - 628976
• This content is not included.BZ - 745410

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.