Issued:

2017-02-20

Updated:

2017-02-20

RHSA-2017:0286 - Moderate: openssl security update

Synopsis

Moderate: openssl security update

Type/Severity

Security Advisory Moderate

Topic

An update for openssl is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

• An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731)

• A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.

Affected Products

Updated Packages

• openssl-debuginfo-1.0.1e-60.el7_3.1.ppc64le.rpm
• openssl-libs-1.0.1e-60.el7_3.1.ppc.rpm
• openssl-1.0.1e-48.el6_8.4.x86_64.rpm
• openssl-libs-1.0.1e-60.el7_3.1.s390x.rpm
• openssl-perl-1.0.1e-48.el6_8.4.x86_64.rpm
• openssl-1.0.1e-60.el7_3.1.src.rpm
• openssl-perl-1.0.1e-60.el7_3.1.x86_64.rpm
• openssl-devel-1.0.1e-60.el7_3.1.i686.rpm
• openssl-debuginfo-1.0.1e-60.el7_3.1.i686.rpm
• openssl-debuginfo-1.0.1e-60.el7_3.1.s390.rpm
• openssl-1.0.1e-48.el6_8.4.i686.rpm
• openssl-devel-1.0.1e-48.el6_8.4.ppc64.rpm
• openssl-debuginfo-1.0.1e-48.el6_8.4.ppc.rpm
• openssl-libs-1.0.1e-60.el7_3.1.ppc64.rpm
• openssl-devel-1.0.1e-48.el6_8.4.s390x.rpm
• openssl-static-1.0.1e-48.el6_8.4.i686.rpm
• openssl-static-1.0.1e-60.el7_3.1.aarch64.rpm
• openssl-1.0.1e-48.el6_8.4.ppc.rpm
• openssl-devel-1.0.1e-48.el6_8.4.s390.rpm
• openssl-static-1.0.1e-48.el6_8.4.ppc64.rpm
• openssl-devel-1.0.1e-60.el7_3.1.ppc.rpm
• openssl-static-1.0.1e-60.el7_3.1.x86_64.rpm
• openssl-1.0.1e-60.el7_3.1.s390x.rpm
• openssl-1.0.1e-48.el6_8.4.src.rpm
• openssl-perl-1.0.1e-48.el6_8.4.s390x.rpm
• openssl-static-1.0.1e-60.el7_3.1.s390.rpm
• openssl-debuginfo-1.0.1e-60.el7_3.1.ppc.rpm
• openssl-debuginfo-1.0.1e-60.el7_3.1.aarch64.rpm
• openssl-perl-1.0.1e-60.el7_3.1.aarch64.rpm
• openssl-devel-1.0.1e-48.el6_8.4.ppc.rpm
• openssl-devel-1.0.1e-60.el7_3.1.aarch64.rpm
• openssl-debuginfo-1.0.1e-48.el6_8.4.ppc64.rpm
• openssl-static-1.0.1e-48.el6_8.4.x86_64.rpm
• openssl-static-1.0.1e-60.el7_3.1.s390x.rpm
• openssl-1.0.1e-48.el6_8.4.ppc64.rpm
• openssl-1.0.1e-60.el7_3.1.ppc64le.rpm
• openssl-1.0.1e-48.el6_8.4.s390.rpm
• openssl-perl-1.0.1e-48.el6_8.4.i686.rpm
• openssl-perl-1.0.1e-60.el7_3.1.ppc64le.rpm
• openssl-libs-1.0.1e-60.el7_3.1.s390.rpm
• openssl-perl-1.0.1e-48.el6_8.4.ppc64.rpm
• openssl-static-1.0.1e-48.el6_8.4.s390x.rpm
• openssl-static-1.0.1e-60.el7_3.1.ppc64le.rpm
• openssl-1.0.1e-60.el7_3.1.ppc64.rpm
• openssl-devel-1.0.1e-60.el7_3.1.ppc64le.rpm
• openssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm
• openssl-1.0.1e-48.el6_8.4.s390x.rpm
• openssl-debuginfo-1.0.1e-48.el6_8.4.x86_64.rpm
• openssl-1.0.1e-60.el7_3.1.x86_64.rpm
• openssl-devel-1.0.1e-60.el7_3.1.s390x.rpm
• openssl-1.0.1e-60.el7_3.1.aarch64.rpm
• openssl-debuginfo-1.0.1e-60.el7_3.1.ppc64.rpm
• openssl-devel-1.0.1e-60.el7_3.1.s390.rpm
• openssl-debuginfo-1.0.1e-60.el7_3.1.s390x.rpm
• openssl-devel-1.0.1e-60.el7_3.1.ppc64.rpm
• openssl-devel-1.0.1e-60.el7_3.1.x86_64.rpm
• openssl-perl-1.0.1e-60.el7_3.1.s390x.rpm
• openssl-libs-1.0.1e-60.el7_3.1.aarch64.rpm
• openssl-debuginfo-1.0.1e-48.el6_8.4.s390.rpm
• openssl-libs-1.0.1e-60.el7_3.1.ppc64le.rpm
• openssl-static-1.0.1e-60.el7_3.1.i686.rpm
• openssl-devel-1.0.1e-48.el6_8.4.i686.rpm
• openssl-libs-1.0.1e-60.el7_3.1.x86_64.rpm
• openssl-static-1.0.1e-60.el7_3.1.ppc.rpm
• openssl-debuginfo-1.0.1e-48.el6_8.4.s390x.rpm
• openssl-debuginfo-1.0.1e-60.el7_3.1.x86_64.rpm
• openssl-libs-1.0.1e-60.el7_3.1.i686.rpm
• openssl-perl-1.0.1e-60.el7_3.1.ppc64.rpm
• openssl-static-1.0.1e-60.el7_3.1.ppc64.rpm
• openssl-devel-1.0.1e-48.el6_8.4.x86_64.rpm

Fixes

• This content is not included.BZ - 1384743
• This content is not included.BZ - 1416852

CVEs

• CVE-2016-8610
• CVE-2017-3731

References

• https://access.redhat.com/security/updates/classification/#moderate
• Content from www.openssl.org is not included.Content from www.openssl.org is not included.https://www.openssl.org/news/secadv/20170126.txt

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.