Bug 1103586 (CVE-2014-0224)
| Summary: | CVE-2014-0224 openssl: SSL/TLS MITM vulnerability | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Huzaifa S. Sidhpurwala <huzaifas> | ||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||
| Status: | CLOSED ERRATA | QA Contact: | |||||
| Severity: | high | Docs Contact: | |||||
| Priority: | high | ||||||
| Version: | unspecified | CC: | aavati, abaron, acathrow, aneelica, aortega, apevec, ayoung, bazulay, bigbangiyan, carnil, cdewolf, cfergeau, chrisw, cpelland, dallan, darran.lofthouse, dblechte, fdeutsch, fnasser, fweimer, gkotton, hkario, huwang, idith, iheim, jawilson, jclere, jkurik, jrusnack, kengert, lgao, lhh, markmc, mmcallis, mturk, myarboro, nlevinki, pgier, pmatouse, pslavice, rbryant, rfortier, rsvoboda, sclewis, security-response-team, ssaha, tmraz, vbellur, vtunka, weli, yeylon | ||||
| Target Milestone: | --- | Keywords: | Security | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | openssl 1.0.1h, openssl 1.0.0m, openssl 0.9.8za | Doc Type: | Bug Fix | ||||
| Doc Text: |
It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server.
|
Story Points: | --- | ||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2014-06-11 05:28:24 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 1096233, 1096234, 1103604, 1103605, 1103606, 1103607, 1103608, 1103609, 1103610, 1103611, 1103632, 1103633, 1103634, 1103635, 1103653, 1103654, 1103655, 1103656, 1103657, 1103659, 1103723, 1103724, 1103741, 1103885, 1103886, 1103887, 1103888, 1103889, 1103890, 1104349, 1104350, 1127888, 1127889 | ||||||
| Bug Blocks: | 1103601, 1103903, 1103904, 1103905 | ||||||
| Attachments: |
|
||||||
|
Description
Huzaifa S. Sidhpurwala
2014-06-02 07:17:00 UTC
Created attachment 901373 [details]
Upstream patch
External References: https://www.openssl.org/news/secadv_20140605.txt https://access.redhat.com/site/articles/904433 https://access.redhat.com/site/solutions/905793 Upstream commits: OpenSSL-1.0.1: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=bc8923b1ec9c467755cd86f7848c50ee8812e441 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=006cd7083f76ed5cb0d9a914857e9231ef1bc317 OpenSSL-0.9.8: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=410a49a4fa1d2a1a9775ee29f9e40cbbda79c149 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=897169fdf06bf75b4d0c503d61abb45656dd90a6 Fixed upstream in versions 1.0.1h, 1.0.0m and 0.9.8za. This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2014:0625 https://rhn.redhat.com/errata/RHSA-2014-0625.html This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2014:0624 https://rhn.redhat.com/errata/RHSA-2014-0624.html This issue has been addressed in following products: Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 Via RHSA-2014:0626 https://rhn.redhat.com/errata/RHSA-2014-0626.html Created openssl tracking bugs for this issue: Affects: fedora-all [bug 1096233] Created mingw-openssl tracking bugs for this issue: Affects: fedora-all [bug 1096234] This issue has been addressed in following products: Red Hat Storage 2.1 Via RHSA-2014:0628 https://rhn.redhat.com/errata/RHSA-2014-0628.html This issue has been addressed in following products: Red Hat Enterprise Linux 4 Extended Lifecycle Support Red Hat Enterprise Linux 5.6 Long Life Red Hat Enterprise Linux 5.9 EUS - Server Only Red Hat Enterprise Linux 6.3 EUS - Server and Compute Node Only Red Hat Enterprise Linux 6.4 EUS - Server and Compute Node Only Red Hat Enterprise Linux 6.2 AUS Via RHSA-2014:0627 https://rhn.redhat.com/errata/RHSA-2014-0627.html IssueDescription: It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server. This issue has been addressed in following products: Red Hat JBoss Enterprise Web Platform 5.2.0 Via RHSA-2014:0633 https://rhn.redhat.com/errata/RHSA-2014-0633.html This issue has been addressed in following products: Red Hat JBoss Web Server 2.0.1 Via RHSA-2014:0632 https://rhn.redhat.com/errata/RHSA-2014-0632.html This issue has been addressed in following products: Red Hat JBoss Enterprise Application Platform 5.2.0 Via RHSA-2014:0630 https://rhn.redhat.com/errata/RHSA-2014-0630.html This issue has been addressed in following products: RHEV-H and Agents for RHEL-6 Via RHSA-2014:0629 https://rhn.redhat.com/errata/RHSA-2014-0629.html This issue has been addressed in following products: Red Hat JBoss Enterprise Application Platform 6.2.3 Via RHSA-2014:0631 https://rhn.redhat.com/errata/RHSA-2014-0631.html openssl-1.0.1e-38.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report. openssl-1.0.1e-38.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report. This issue has been addressed in following products: Red Hat Enterprise Linux 7 Via RHSA-2014:0680 https://rhn.redhat.com/errata/RHSA-2014-0680.html This issue has been addressed in following products: Red Hat Enterprise Linux 7 Via RHSA-2014:0679 https://rhn.redhat.com/errata/RHSA-2014-0679.html Created mingw32-openssl tracking bugs for this issue: Affects: epel-5 [bug 1127888] |