Bug 1891836 (CVE-1999-0428) - CVE-1999-0428 openssl: allow remote attackers to reuse SSL sessions and bypass access controls
Summary: CVE-1999-0428 openssl: allow remote attackers to reuse SSL sessions and bypas...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-1999-0428
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1891837
TreeView+ depends on / blocked
 
Reported: 2020-10-27 13:47 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-02-16 19:00 UTC (History)
50 users (show)

Fixed In Version: openssl 0.9.2b
Clone Of:
Environment:
Last Closed: 2020-10-28 08:21:15 UTC
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2020-10-27 13:47:51 UTC 
OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls.

Reference:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0428
Comment 1 juneau 2020-10-27 16:56:22 UTC 
Services unaffected. This is an 11 year-old CVE (that was resolved 11 years ago) which has somehow reappeared.
Comment 3 Product Security DevOps Team 2020-10-28 08:21:15 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-1999-0428
Comment 4 RaTasha Tillery-Smith 2020-10-28 13:00:13 UTC 
Statement:

OpenSSL, as shipped with Red Hat Enterprise Linux 5, 6, 7, and 8, is not affected by this flaw because newer versions of OpenSSL that have already been patched are shipped. This vulnerability was originally published over 20 years ago. It affects OpenSSL versions < 0.92b, which are not shipped in Red Hat products.
Note You need to log in before you can comment on or make changes to this bug.