Important: Red Hat Security Advisory: openssl security update

Updated openssl packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 Extended Lifecycle Support. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

Security Advisory 0018

Security Advisory 0018 PDF Date: March 1st, 2016 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | March 1st, 2016 | Initial release. Issue under investigation. 1.1 | March 7th, 2016 | Updated to include assessment Arista Products vulnerability report for security vulnerabilities released ...

openssl security update

1.0.1e-42.4 - fix CVE-2016-0702 - side channel attack on modular exponentiation - fix CVE-2016-0705 - double-free in DSA private key parsing - fix CVE-2016-0797 - heap corruption in BNhex2bn and BNdec2bn 1.0.1e-42.3 - fix CVE-2015-3197 - SSLv2 ciphersuite enforcement - disable SSLv2 in the generi...

openssl security update

1.0.1e-51.4 - fix CVE-2016-0702 - side channel attack on modular exponentiation - fix CVE-2016-0705 - double-free in DSA private key parsing - fix CVE-2016-0797 - heap corruption in BNhex2bn and BNdec2bn 1.0.1e-51.3 - fix CVE-2015-3197 - SSLv2 ciphersuite enforcement - disable SSLv2 in the generi...

DLA-421-1 openssl - security update

Bulletin has no description...

F5 Networks BIG-IP : OpenSSL vulnerability (SOL33209124) (deprecated)

ssl/s2srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the getclientmasterkey and...

SA111 : OpenSSL Vulnerabilities 28-Jan-2016

SUMMARY Blue Coat products using affected versions of OpenSSL 1.0.2, 1.0.1, and 0.9.8 are susceptible to multiple vulnerabilities. A remote attacker can exploit these vulnerabilities to obtain ephemeral Diffie-Hellman DHE private key information and perform man-in-the-middle attacks on SSL/TLS...

CVE-2015-3197

ssl/s2srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the getclientmasterkey and...

BELL-CVE-2015-3197 CVE-2015-3197 does not affect BellSoft software

Bulletin has no description...

openSUSE Security Update : openssl (openSUSE-2016-203)

This update for openssl fixes the following issues : - CVE-2015-3197: A malicious client can negotiate SSLv2 ciphers that have been disabled on the server and complete SSLv2 handshakes even if all SSLv2 ciphers have been disabled, provided that the SSLv2 protocol was not also disabled via...

CVE-2015-3197

OpenSSL CVE-2015-3197 affects the SSLv2 handling in OpenSSL 1.0.1 prior to 1.0.1r and 1.0.2 prior to 1.0.2f, where SSLv2 ciphers marked as disabled could still be negotiated, enabling a MITM through SSLv2 traffic. The issue is tied to the get_client_master_key and get_client_hello paths in ssl/s2...

[slackware-security] openssl

New openssl packages are available for Slackware 14.0, 14.1, and -current to fix a security issue. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/openssl-1.0.1r-i486-1slack14.1.txz: Upgraded. This update fixes the following security issue: SSLv2 doesn't block disabled...

OpenSSL 1.0.2 < 1.0.2f Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.2f. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.2f advisory. - The DHcheckpubkey function in crypto/dh/dhcheck.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriat...

openssl: Security update (2 CVEs)

The openssl package has been rebuilt and was uploaded to the Barrier Breaker 14.07 repository due to multiple security issues. VERSION 1.0.2e-1 = 1.0.2f-1 CHANGELOG Fri, 29 Jan 2016 13:25:24 +0000 b763ba2 Openssl: update to 1.0.2f fixes CVE-2016-0701, CVE-2015-3197 CHANGES...

CVE-2016-3197

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-3197. Reason: This candidate is a duplicate of CVE-2015-3197. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2015-3197 instead of this candidate. All references and descriptions in this...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-3197. Reason: This candidate is a duplicate of CVE-2015-3197. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2015-3197 instead of this candidate. All references and descriptions in this...

CVE-2016-3197

...

CVE-2016-3197

CVE-2016-3197 is rejected/not used per the description.

FreeBSD : openssl -- multiple vulnerabilities (3679fd10-c5d1-11e5-b85f-0018fe623f2b)

OpenSSL project reports : - Historically OpenSSL only ever generated DH parameters based on 'safe' primes. More recently in version 1.0.2 support was provided for generating X9.42 style parameter files such as those required for RFC 5114 support. The primes used in such files may not be 'safe'...

openssl: man-in-the-middle

CVE-2015-3197 man-in-the-middle A flaw was found in the way malicious SSL/TLS clients could negotiate SSLv2 ciphers that have been disabled on the server. This could result in weak SSLv2 ciphers being used for SSL/TLS connections, making them vulnerable to man-in-the-middle attacks. -...