Red Hat Security Blog: March 2015 archives

  • Not using IPv6? Are you sure?

    Internet Protocol version 6 (IPv6) has been around for many years and was first supported in Red Hat Enterprise Linux 6 in 2010.  Designed to provide, among other things, additional address space on the ever-growing Internet, IPv6 has only recently become a priority for ISPs and businesses. On February 3, 2011, ICANN announced that the available pool of unallocated IPv4 addresses had been completely emptied and urged network operators and server owners to implement IPv6 if they had not...
    Posted 2015-03-25T13:30:48+00:00 - 0
  • CWE Vulnerability Assessment Report 2014

    Last year is almost three months over and we have been busy completing the CWE statistics of our vulnerabilities. The biggest change from the year before is the scale of the data - CWE report for 2013 was based on 37 classified vulnerabilities, whereas last year we classified 617 vulnerabilities in our bugzilla. Out of them 61 were closed with resolution NOTABUG, which means they were either not a security issues, or did not affect Red Hat products. These still include vulnerabilities which...
    Posted 2015-03-18T14:30:23+00:00 - 0
  • CWE update

    In the past Red Hat Product Security assigned weakness IDs only to vulnerabilities that meet certain criteria, more precisely, only vulnerabilities with CVSS score higher than 7. Since the number of incoming vulnerabilities was high, this filtering allowed us to focus on vulnerabilities that matter most. However, it also makes statistics incomplete, missing low and moderate vulnerabilities. In the previous year we started assigning weakness IDs to almost all vulnerabilities, greatly...
    Posted 2015-03-11T14:30:24+00:00 - 0
  • Factoring RSA export keys - FREAK (CVE-2015-0204)

    This week's issue with OpenSSL export ciphersuites has been discussed in the press as "Freak" and "Smack". These are addressed by CVE-2015-0204, and updates for affected Red Hat products were released in January. Historically, the United States and several other countries tried to control the export or use of strong cryptographic primitives. For example, any company that exported cryptographic products from the United States needed to comply with certain key size limits. For RSA encryption,...
    Posted 2015-03-04T14:45:50+00:00 - 0
Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.