RHBA-2011:1010 - Bug Fix Advisory

Topic

Updated openssl packages that fix several bugs and add various enhancements are
now available for Red Hat Enterprise Linux 5.

Description

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and
Transport Layer Security (TLS) protocols, as well as a full-strength
general-purpose cryptography library.

This update fixes the following bugs:

• Prior to this update, the "s_server" command refused to handle connections

from clients with an unresolvable IP address and terminated with this error
message: "getnameinfo failed". This problem has been fixed: the "s_server"
command now does not terminate even if the IP address of the client is not
resolvable. (BZ#561260)

• Prior to this update, the openssl packages were not fully compliant with the

TLS protocol. As a consequence, the system did not accept a connection from a
client indicating that it supports the TLS protocol version 4.1. With this
update, the server now accepts connections from such clients, which fixes the
problem. (BZ#599112)

• Prior to this update, repeatedly loading and unloading the CHIL engine by a

calling program caused the calling program to terminate unexpectedly due to a
function pointer not being cleared after the engine was unloaded. This bug has
been fixed, and the calling program does not crash anymore. (BZ#622003)

• Prior to this update, a check for a weak public key was missing while the

Diffie-Hellman key was computed. With this update, the DH_check_pub_key()
function call has been added to the DH_compute_key() function, which solves this
low impact problem. (BZ#698175)

• The CHIL Engine is used to access Thales or nCipher hardware devices. Prior to

this update, when attempting to load the CHIL engine into the openssl utility,
the CHIL engine required thread locking callbacks to be set regardless of
whether the calling program was multithreaded. With this update, this unexpected
requirement has been removed. (BZ#671484)

• Prior to this update, when running a multithreaded OpenSSL client application

that tried to connect to a server simultaneously with multiple threads, a TLS
protocol error could have occurred. This bug has been fixed in this update and
no longer occurs. (BZ#688901)

In addition, this update provides the following enhancements:

• Prior to this update, manual and help pages for various sub-commands of the

openssl utility did not specify all the digest algorithms. With this update, the
aforementioned pages have been modified, and users are now pointed to the
"openssl dgst -h" command that lists all the available digests. (BZ#608639)

• The StartCom Free SSL Certification Authority and VeriSign Class 3 Public

Primary Certification Authority - G5 certificates were added to the
/etc/pki/tls/certs/ca-bundle.crt file that contains the certificates of trusted
certification authorities. (BZ#675671, BZ#617856)

• The support for peer certificates that use the SHA-256 and SHA-512 hashing

algorithms is now enabled by default even if the application calls only the
SSL_library_init() function without the OpenSSL_add_all_algorithms() call.
(BZ#676384)

All users of OpenSSL should upgrade to these updated packages, which fix these
bugs and add these enhancements.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 561260 - s_server quits when receiving a connection from an unresolvable IP
• BZ - 599112 - openssl-0.9.8e-12.el5_4.6 is TLS non-compliant (version intolerance)
• BZ - 608639 - man pages and help text do not list all digests
• BZ - 622003 - Calling program crashes when loading OpenSSL CHIL Engine twice
• BZ - 671484 - Backport OpenSSL RT #1736, CHIL Engine thread lock upcall management
• BZ - 675671 - Root CA cert bundle is missing "VeriSign Class 3 Public Primary Certification Authority - G5" cert
• BZ - 676384 - OpenSSL / PAM & NSS_LDAP / SUDO fail TLS_CHECKPEER with Cipher AES256-SHA
• BZ - 688901 - occasional 502 errors on httpd load balancer
• BZ - 698175 - Add call to DH_check_pub_key() in DH_compute_key() by Diffie-Hellman key exchange

CVEs

(none)

References

(none)