As per Upstream security advisory: A side-channel attack was found which makes use of cache-bank conflicts on the Intel Sandy-Bridge microarchitecture which could lead to the recovery of RSA keys. The ability to exploit this issue is limited as it relies on an attacker who has control of code in a thread running on the same hyper-threaded core as the victim thread which is performing decryptions. This issue affects OpenSSL versions 1.0.2 and 1.0.1. OpenSSL 1.0.2 users should upgrade to 1.0.2g OpenSSL 1.0.1 users should upgrade to 1.0.1s This issue was reported to OpenSSL on Jan 8th 2016 by Yuval Yarom, The University of Adelaide and NICTA, Daniel Genkin, Technion and Tel Aviv University, and Nadia Heninger, University of Pennsylvania with more information at http://cachebleed.info. The fix was developed by Andy Polyakov of OpenSSL.
Acknowledgments: Name: the OpenSSL project Upstream: Yuval Yarom (University of Adelaide and NICTA), Daniel Genkin (Technion and Tel Aviv University), Nadia Heninger (University of Pennsylvania)
External References: http://cachebleed.info/ https://www.openssl.org/news/secadv/20160301.txt
Related upstream commits: https://git.openssl.org/?p=openssl.git;a=commitdiff;h=d6482a82bc2228327aa4ba98aeeecd9979542a31 https://git.openssl.org/?p=openssl.git;a=commitdiff;h=5ea08bd2fe6538cbccd89f07e6f1cdd5d3e75e3f https://git.openssl.org/?p=openssl.git;a=commitdiff;h=d6d422e1ec48fac1c6194ab672e320281a214a32 https://git.openssl.org/?p=openssl.git;a=commitdiff;h=8fc8f486f7fa098c9fbb6a6ae399e3c6856e0d87 https://git.openssl.org/?p=openssl.git;a=commitdiff;h=317be63875e59efa34be0075eaff3c033ef6969f
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2016:0301 https://rhn.redhat.com/errata/RHSA-2016-0301.html
openssl-1.0.2g-2.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in the following products: RHEV-H and Agents for RHEL-6 RHEV-H and Agents for RHEL-7 Via RHSA-2016:0379 https://rhn.redhat.com/errata/RHSA-2016-0379.html
openssl-1.0.1k-14.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
openssl101e-1.0.1e-7.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in the following products: Via RHSA-2016:2957 https://rhn.redhat.com/errata/RHSA-2016-2957.html