Mitigate FREAK: OpenSSL vulnerability (CVE-2015-0204) on RHEL5

Latest response

Red Hat doesn't plan to release an OpenSSL patch for RHEL5

We have over 50 RHEL5 servers at our facility. The current OpenSSL version is openssl-0.9.8e-[12-32]

The Red Hat Knowledgebase article (https://access.redhat.com/articles/1369543) gives two examples of how to mitigate FREAK:

1) openssl ciphers MEDIUM
I guess I could write a wrapper script:
a) Rename /usr/bin/openssl to something else
b) Write a script which calls the renamed binary with the two parameters

2) /etc/httpd/conf.d/ssl.conf
SSLCipherSuite HIGH:!aNULL:!MD5:!EXP

Will these two modifications mitigate FREAK?

If not, does anyone know how to mitigate it?

Thanks for any help you can provide,
Scott Bringen

sc

Responses