Bug 1891836 (CVE-1999-0428)

Summary:	CVE-1999-0428 openssl: allow remote attackers to reuse SSL sessions and bypass access controls
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aboyko, asoldano, atangrin, bbaranow, bmaxwell, brian.stansberry, cdewolf, chazlett, crypto-team, csutherl, darran.lofthouse, dkreling, dosoudil, eleandro, gghezzo, gparvin, gzaronik, iweiss, jawilson, jclere, jochrist, jorton, jperkins, jramanat, jweiser, jwon, krathod, kwills, lersek, lgao, mbabacek, msochure, msvehla, mturk, myarboro, nwallace, philmd, pjindal, pmackay, redhat-bugzilla, rguimara, rh-spice-bugs, rstancel, rsvoboda, smaestri, stcannon, thee, tmraz, tom.jenkinson, weli
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	openssl 0.9.2b	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-10-28 08:21:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1891837

Description Guilherme de Almeida Suckevicz 2020-10-27 13:47:51 UTC

OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls.

Reference:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0428

Comment 1 juneau 2020-10-27 16:56:22 UTC

Services unaffected. This is an 11 year-old CVE (that was resolved 11 years ago) which has somehow reappeared.

Comment 3 Product Security DevOps Team 2020-10-28 08:21:15 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-1999-0428

Comment 4 RaTasha Tillery-Smith 2020-10-28 13:00:13 UTC

Statement:

OpenSSL, as shipped with Red Hat Enterprise Linux 5, 6, 7, and 8, is not affected by this flaw because newer versions of OpenSSL that have already been patched are shipped. This vulnerability was originally published over 20 years ago. It affects OpenSSL versions < 0.92b, which are not shipped in Red Hat products.