| Description: | OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3)and Transport Layer Security (TLS v1) protocols, as well as afull-strength, general purpose cryptography library.It was found that OpenSSL clients and servers could be forced, via aspecially crafted handshake packet, to use weak keying material forcommunication. A man-in-the-middle attacker could use this flaw to decryptand modify traffic between a client and a server. (CVE-2014-0224)Note: In order to exploit this flaw, both the server and the client must beusing a vulnerable version of OpenSSL; the server must be using OpenSSLversion 1.0.1 and above, and the client must be using any version ofOpenSSL. For more information about this flaw, refer to:https://access.redhat.com/site/articles/904433A buffer overflow flaw was found in the way OpenSSL handled invalid DTLSpacket fragments. A remote attacker could possibly use this flaw to executearbitrary code on a DTLS client or server. (CVE-2014-0195)Multiple flaws were found in the way OpenSSL handled read and write bufferswhen the SSL_MODE_RELEASE_BUFFERS mode was enabled. A TLS/SSL client orserver using OpenSSL could crash or unexpectedly drop connections whenprocessing certain SSL traffic. (CVE-2010-5298, CVE-2014-0198)A denial of service flaw was found in the way OpenSSL handled certain DTLSServerHello requests. A specially crafted DTLS handshake packet could causea DTLS client using OpenSSL to crash. (CVE-2014-0221)A NULL pointer dereference flaw was found in the way OpenSSL performedanonymous Elliptic Curve Diffie Hellman (ECDH) key exchange. A speciallycrafted handshake packet could cause a TLS/SSL client that has theanonymous ECDH cipher suite enabled to crash. (CVE-2014-3470)Red Hat would like to thank the OpenSSL project for reporting these issues.Upstream acknowledges KIKUCHI Masashi of Lepidum as the original reporterof CVE-2014-0224, Jüri Aedla as the original reporter of CVE-2014-0195,Imre Rad of Search-Lab as the original reporter of CVE-2014-0221, and FelixGröbert and Ivan Fratrić of Google as the original reporters ofCVE-2014-3470.All OpenSSL users are advised to upgrade to these updated packages, whichcontain backported patches to correct these issues. For the update to takeeffect, all services linked to the OpenSSL library (such as httpd and otherSSL-enabled services) must be restarted or the system rebooted. |