Pat,
I am now thoroughly confused.
Two erratas just arrived for openssl - both with the same CVE numbers,
but different Advisory ID's, *and* with different versions of openssl.
(see referenced emails below).
I just checked my SL5.x systems and they are showing
openssl-0.9.8e-27.el5_10.3.i686 updated 6/5/14, the same version
your showing in the 2nd email (2nd email below).
I checked my SL6.x systems and they are showing
openssl-1.0.1e-16.el6_5.14.x86_64, a *later* version than what
your showing in the first email (1st email below)
Thanks!
- Larry
Pat Riehecky wrote on 6/11/2014 10:32 AM:> Synopsis: Important: openssl
security update
> Advisory ID: SLSA-2014:0627-1
> Issue Date: 2014-06-05
> CVE Numbers: CVE-2014-0224
> --
>
> It was found that OpenSSL clients and servers could be forced, via a
> specially crafted handshake packet, to use weak keying material for
> communication. A man-in-the-middle attacker could use this flaw to decrypt
> and modify traffic between a client and a server. (CVE-2014-0224)
>
> Note: In order to exploit this flaw, both the server and the client must
> be using a vulnerable version of OpenSSL; the server must be using OpenSSL
> version 1.0.1 and above, and the client must be using any version of
> OpenSSL. For more information about this flaw, refer to:
>
> For the update to take effect, all services linked to the OpenSSL library
> (such as httpd and other SSL-enabled services) must be restarted or the
> system rebooted.
> --
>
> SL5
> x86_64
> openssl-0.9.8e-12.el5_6.12.i686.rpm
> openssl-0.9.8e-12.el5_6.12.x86_64.rpm
> openssl-debuginfo-0.9.8e-12.el5_6.12.i386.rpm
> openssl-debuginfo-0.9.8e-12.el5_6.12.i686.rpm
> openssl-debuginfo-0.9.8e-12.el5_6.12.x86_64.rpm
> openssl-devel-0.9.8e-12.el5_6.12.i386.rpm
> openssl-devel-0.9.8e-12.el5_6.12.x86_64.rpm
> openssl-perl-0.9.8e-12.el5_6.12.x86_64.rpm
> openssl-0.9.8e-26.el5_9.4.i686.rpm
> openssl-0.9.8e-26.el5_9.4.x86_64.rpm
> openssl-debuginfo-0.9.8e-26.el5_9.4.i386.rpm
> openssl-debuginfo-0.9.8e-26.el5_9.4.i686.rpm
> openssl-debuginfo-0.9.8e-26.el5_9.4.x86_64.rpm
> openssl-devel-0.9.8e-26.el5_9.4.i386.rpm
> openssl-devel-0.9.8e-26.el5_9.4.x86_64.rpm
> openssl-perl-0.9.8e-26.el5_9.4.x86_64.rpm
> i386
> openssl-0.9.8e-12.el5_6.12.i386.rpm
> openssl-0.9.8e-12.el5_6.12.i686.rpm
> openssl-debuginfo-0.9.8e-12.el5_6.12.i386.rpm
> openssl-debuginfo-0.9.8e-12.el5_6.12.i686.rpm
> openssl-devel-0.9.8e-12.el5_6.12.i386.rpm
> openssl-perl-0.9.8e-12.el5_6.12.i386.rpm
> openssl-0.9.8e-26.el5_9.4.i386.rpm
> openssl-0.9.8e-26.el5_9.4.i686.rpm
> openssl-debuginfo-0.9.8e-26.el5_9.4.i386.rpm
> openssl-debuginfo-0.9.8e-26.el5_9.4.i686.rpm
> openssl-devel-0.9.8e-26.el5_9.4.i386.rpm
> openssl-perl-0.9.8e-26.el5_9.4.i386.rpm
> SL6
> x86_64
> openssl-1.0.0-25.el6_3.3.i686.rpm
> openssl-1.0.0-25.el6_3.3.x86_64.rpm
> openssl-debuginfo-1.0.0-25.el6_3.3.i686.rpm
> openssl-debuginfo-1.0.0-25.el6_3.3.x86_64.rpm
> openssl-1.0.0-27.el6_4.4.i686.rpm
> openssl-1.0.0-27.el6_4.4.x86_64.rpm
> openssl-debuginfo-1.0.0-27.el6_4.4.i686.rpm
> openssl-debuginfo-1.0.0-27.el6_4.4.x86_64.rpm
> openssl-devel-1.0.0-25.el6_3.3.i686.rpm
> openssl-devel-1.0.0-25.el6_3.3.x86_64.rpm
> openssl-perl-1.0.0-25.el6_3.3.x86_64.rpm
> openssl-static-1.0.0-25.el6_3.3.x86_64.rpm
> openssl-devel-1.0.0-27.el6_4.4.i686.rpm
> openssl-devel-1.0.0-27.el6_4.4.x86_64.rpm
> openssl-perl-1.0.0-27.el6_4.4.x86_64.rpm
> openssl-static-1.0.0-27.el6_4.4.x86_64.rpm
> i386
> openssl-1.0.0-25.el6_3.3.i686.rpm
> openssl-debuginfo-1.0.0-25.el6_3.3.i686.rpm
> openssl-devel-1.0.0-25.el6_3.3.i686.rpm
> openssl-1.0.0-27.el6_4.4.i686.rpm
> openssl-debuginfo-1.0.0-27.el6_4.4.i686.rpm
> openssl-devel-1.0.0-27.el6_4.4.i686.rpm
> openssl-perl-1.0.0-25.el6_3.3.i686.rpm
> openssl-static-1.0.0-25.el6_3.3.i686.rpm
> openssl-perl-1.0.0-27.el6_4.4.i686.rpm
> openssl-static-1.0.0-27.el6_4.4.i686.rpm
>
> - Scientific Linux Development Team
>
Pat Riehecky wrote on 6/11/2014 10:33 AM:
Synopsis: Important: openssl security update
Advisory ID: SLSA-2014:0624-1
Issue Date: 2014-06-05
CVE Numbers: CVE-2014-0224
--
It was found that OpenSSL clients and servers could be forced, via a
specially crafted handshake packet, to use weak keying material for
communication. A man-in-the-middle attacker could use this flaw to decrypt
and modify traffic between a client and a server. (CVE-2014-0224)
Note: In order to exploit this flaw, both the server and the client must
be using a vulnerable version of OpenSSL; the server must be using OpenSSL
version 1.0.1 and above, and the client must be using any version of
OpenSSL. For more information about this flaw, refer to:
For the update to take effect, all services linked to the OpenSSL library
(such as httpd and other SSL-enabled services) must be restarted or the
system rebooted.
--
SL5
x86_64
openssl-0.9.8e-27.el5_10.3.i686.rpm
openssl-0.9.8e-27.el5_10.3.x86_64.rpm
openssl-debuginfo-0.9.8e-27.el5_10.3.i686.rpm
openssl-debuginfo-0.9.8e-27.el5_10.3.x86_64.rpm
openssl-perl-0.9.8e-27.el5_10.3.x86_64.rpm
openssl-debuginfo-0.9.8e-27.el5_10.3.i386.rpm
openssl-devel-0.9.8e-27.el5_10.3.i386.rpm
openssl-devel-0.9.8e-27.el5_10.3.x86_64.rpm
i386
openssl-0.9.8e-27.el5_10.3.i386.rpm
openssl-0.9.8e-27.el5_10.3.i686.rpm
openssl-debuginfo-0.9.8e-27.el5_10.3.i386.rpm
openssl-debuginfo-0.9.8e-27.el5_10.3.i686.rpm
openssl-perl-0.9.8e-27.el5_10.3.i386.rpm
openssl-devel-0.9.8e-27.el5_10.3.i386.rpm
- Scientific Linux Development Team
--
P. Larry Nelson (217-244-9855) | Systems/Network Administrator
461 Loomis Lab | High Energy Physics Group
1110 W. Green St., Urbana, IL | Physics Dept., Univ. of Ill.
MailTo:[email protected] | http://www.roadkill.com/lnelson/
-------------------------------------------------------------------
"Information without accountability is just noise." - P.L. Nelson
