| Description: | OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3)and Transport Layer Security (TLS v1) protocols, as well as afull-strength, general purpose cryptography library.It was found that OpenSSL clients and servers could be forced, via aspecially crafted handshake packet, to use weak keying material forcommunication. A man-in-the-middle attacker could use this flaw to decryptand modify traffic between a client and a server. (CVE-2014-0224)Note: In order to exploit this flaw, both the server and the client must beusing a vulnerable version of OpenSSL; the server must be using OpenSSLversion 1.0.1 and above, and the client must be using any version ofOpenSSL. For more information about this flaw, refer to:https://access.redhat.com/site/articles/904433Red Hat would like to thank the OpenSSL project for reporting this issue.Upstream acknowledges KIKUCHI Masashi of Lepidum as the original reporterof this issue.All OpenSSL users are advised to upgrade to these updated packages, whichcontain a backported patch to correct this issue. For the update to takeeffect, all services linked to the OpenSSL library (such as httpd and otherSSL-enabled services) must be restarted or the system rebooted. |