RHBA-2009:0181 - Bug Fix Advisory

Topic

Updated openssl packages that fix various bugs are now available.

Description

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3)
and Transport Layer Security (TLS v1) protocols, as well as a full-strength
general purpose cryptography library.

These updated packages fix the following bugs:

• by default, zlib compression is used for SSL and TLS connections. On

IBM System z architectures with Central Processor Assist for Cryptographic
Function (CPACF), compression became the main part of the CPU load, and
total performance was determined by the speed of the compression, not the
speed of the encryption. When compression is disabled, the total
performance is much higher. In these updated packages, zlib compression for
SSL and TLS connections can be disabled with the "OPENSSL_NO_DEFAULT_ZLIB"
environment variable. For TLS connections over a slow network, it is better
to leave compression on, so that the amount of data to be transferred is
lower.

• when using the "openssl" command with the "s_client" and "s_server"

options, the default CA certificates file,
"/etc/pki/tls/certs/ca-bundle.crt", was not read. This resulted in
certificates failing verification. In order for certificates to pass
verification, the "-CAfile /etc/pki/tls/certs/ca-bundle.crt" option had to
be used. In these updated packages, the default CA certificates file is
read, and no longer needs to be specified with the "-CAfile" option.

Also, these updated packages upgrade OpenSSL to a later upstream version,
which is currently undergoing the FIPS-140-2 (Federal Information
Processing Standards) validation process.

Users of openssl are advised to upgrade to these updated packages, which
resolve these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 450987 - should /etc/pki/tls/certs/ca-bundle.crt not be the default one used?

CVEs

(none)

References

(none)