RHBA-2012:0229 - Bug Fix Advisory

Topic

Updated openssl packages that fix a bug and add various enhancements are now
available for Red Hat Enterprise Linux 5.

Description

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and
Transport Layer Security (TLS) protocols, as well as a full-strength
general-purpose cryptography library.

This update fixes the following bug:

• Prior to this update, the openssl configuration file variables with "yes" or

"no" values were parsed incorrectly. The value of "yes" was interpreted as "no".
With this update, the "yes" or "no" values in the configuration file are now
parsed correctly. (BZ#726593)

In addition, this update provides the following enhancements:

• Documentation of possible error states related to the FIPS mode is now

included in the README.FIPS file. (BZ#628976)

• DigiCert Certification Authority certificates were added to the

/etc/pki/tls/certs/ca-bundle.crt file that contains the certificates of trusted
certification authorities. (BZ#735819)

• Known answer self-tests for the SHA2 algorithms (SHA256 and SHA512) were added

to the FIPS mode start up self tests. (BZ#740866)

• The makefile for generating keys and certificates was updated to generate the

private keys with a length of 2048 bits by default as the previous length of
1024 bits is now considered too weak. (BZ#745410)

All users of OpenSSL should upgrade to these updated packages, which fix this
bug and add these enhancements.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 628976 - Update README.FIPS for error state clarification
• BZ - 745410 - Makefile for generating keys and certificates specifies less than the recommended number of bits

CVEs

(none)

References

(none)