Mitigate FREAK: OpenSSL vulnerability (CVE-2015-0204) on RHEL5
Red Hat doesn't plan to release an OpenSSL patch for RHEL5
We have over 50 RHEL5 servers at our facility. The current OpenSSL version is openssl-0.9.8e-[12-32]
The Red Hat Knowledgebase article (https://access.redhat.com/articles/1369543) gives two examples of how to mitigate FREAK:
1) openssl ciphers MEDIUM
I guess I could write a wrapper script:
a) Rename /usr/bin/openssl to something else
b) Write a script which calls the renamed binary with the two parameters
2) /etc/httpd/conf.d/ssl.conf
SSLCipherSuite HIGH:!aNULL:!MD5:!EXP
Will these two modifications mitigate FREAK?
If not, does anyone know how to mitigate it?
Thanks for any help you can provide,
Scott Bringen
Responses
Excellent question, Mr Bringen!! I've got many RHEL 5 servers, and the 'mitigation' steps in the original article are not very useful.
Also, Are there steps I can take to check and see if the mitigation did any good??
L.T.Goodin
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.
