Bug 908052 (CVE-2013-0166)

Summary:	CVE-2013-0166 openssl: DoS due to improper handling of OCSP response verification
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aneelica, djorm, erik-fedora, jason.greene, jclere, jlieskov, ktietz, lfarkas, lgao, mehmetgelisin, rjones, tmraz, weli, yoguma
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	openssl 1.0.1d, openssl 1.0.0k, openssl 0.9.8y	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-07-03 18:05:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	911051, 911052, 911061, 911063, 919303, 919304, 1127896
Bug Blocks:	908053, 920007, 954223, 959037

Description Vincent Danen 2013-02-05 17:56:27 UTC

A flaw was found in the way that OpenSSL handled OCSP response verification, which could be exploited to conduct a denial of service attack.  This flaw affects all versions of OpenSSL and is fixed in versions 1.0.1d, 1.0.0k, and 0.9.8y.

External References:

http://www.openssl.org/news/secadv_20130205.txt

Comment 1 Tomas Hoger 2013-02-06 08:38:44 UTC

Upstream commits:

0.9.8:
http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=66e8211c0b1347970096e04b18aa52567c325200

1.0.0:
http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ebc71865f0506a293242bd4aec97cdc7a8ef24b0

1.0.1:
http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=62e4506a7d4cec1c8e1ff687f6b220f6a62a57c7

Comment 8 Fedora Update System 2013-03-02 19:55:46 UTC

openssl-1.0.1e-3.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 errata-xmlrpc 2013-03-04 21:16:10 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2013:0587 https://rhn.redhat.com/errata/RHSA-2013-0587.html

Comment 10 Fedora Update System 2013-03-08 00:02:31 UTC

openssl-1.0.0k-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 errata-xmlrpc 2013-03-13 14:48:00 UTC

This issue has been addressed in following products:

  RHEV-H and Agents for RHEL-6

Via RHSA-2013:0636 https://rhn.redhat.com/errata/RHSA-2013-0636.html

Comment 16 errata-xmlrpc 2013-05-01 18:04:48 UTC

This issue has been addressed in following products:

  JBoss Enterprise Application Platform 5.2.0

Via RHSA-2013:0783 https://rhn.redhat.com/errata/RHSA-2013-0783.html

Comment 17 errata-xmlrpc 2013-05-01 18:04:57 UTC

This issue has been addressed in following products:

  JBoss Enterprise Web Platform 5.2.0

Via RHSA-2013:0782 https://rhn.redhat.com/errata/RHSA-2013-0782.html

Comment 20 errata-xmlrpc 2013-05-20 14:33:19 UTC

This issue has been addressed in following products:

  JBoss Enterprise Application Platform 6.1.0

Via RHSA-2013:0833 https://rhn.redhat.com/errata/RHSA-2013-0833.html

Comment 25 errata-xmlrpc 2013-07-03 16:19:28 UTC

This issue has been addressed in following products:

  Red Hat JBoss Web Server 2.0.1

Via RHSA-2013:1013 https://rhn.redhat.com/errata/RHSA-2013-1013.html