Synopsis

openssl bug fix and enhancement update

Type/Severity

Bug Fix Advisory

Topic

Updated openssl packages that fix several bugs and add various enhancements are
now available for Red Hat Enterprise Linux 6.

Description

The openssl packages provide a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

The openssl packages have been upgraded to upstream version 1.0.1e, which provides a number of bug fixes and enhancements over the previous version, including support for multiple new cryptographic algorithms and support for the new versions (1.1, 1.2) of the transport layer security (TLS) protocol. This update adds the following ciphers needed for transparent encryption and authentication support in GlusterFS: Cipher-based MAC (CMAC), XEX Tweakable Block Cipher with Ciphertext Stealing (AES-XTS), and Galous Counter Mode (AES-GCM). The following new additional algorithms are now supported: ECDH, ECDSA, and AES-CCM. (BZ#924250)

This update also fixes the following bugs:

• Previously, an incorrect variable size was passed to the getsockopt() function. As a consequence, using the BIO (OpenSSL I/O) layer in datagram mode caused termination with a segmentation fault. More specifically, the openssl s_client command terminated unexpectedly on IBM System z with the "-dtls1" option enabled. After this update, a correctly-sized variable is used, and the datagram BIO functions no longer terminate with a segmentation fault on System z. (BZ#830109)
  
• Prior to this update, the getaddrinfo() function returned an error that was handled incorrectly in the openssl s_server command implementation. Consequently, the OpenSSL s_server did not work on IPv4-only systems. With this update, when getaddrinfo() fails on IPv6 addresses, the code has been modified to fall back to the IPv4 address lookup. As a result, the openssl s_server now correctly starts up on a computer with only IPv4 addresses configured. (BZ#919404)
  

In addition, this update adds the following enhancements:

• The Intel RDRAND instruction is now used, when available, to generate random numbers and has replaced the default OpenSSL random number generator. The instruction is not used when OpenSSL runs in FIPS mode. (BZ#818446)
  
• The performance of OpenSSL on current IBM PowerPC processors has been improved. (BZ#929291)
  
• The elliptic curve digital signature algorithm (ECDSA) and elliptic curve Diffie–Hellman (ECDH) algorithms are now enabled in OpenSSL. These algorithms support only elliptic curves listed in the national institute of standards and technology (NIST) Suite B specification. (BZ#951690)
  
• The new "-trusted_first" option has been added to OpenSSL. This enables preferring locally stored intermediate certificates instead of the intermediate certificates sent by the TLS server. (BZ#951701)
  
• Versions 1.1 and 1.2 of the transport layer security (TLS) protocol are now supported by the OpenSSL library. (BZ#969562)
  
• With this update, the "%{_prefix}" macro is used instead of the hardcoded /usr/ directory in the openssl.spec file when configuring OpenSSL before building. (BZ#969564)
  
• The next protocol negotiation (NPN) extension of the TLS protocol is now supported by OpenSSL. This extension allows for negotiation of the application protocol, which is used by the application, during the TLS handshake. (BZ#987411)
  
• Due to the FIPS validation requirements, the FIPS Power-on self-tests (POST) always have to run when the FIPS module is installed. For libraries, this is ensured by running the self-tests from the dynamic library constructor function. If the dracut-fips package is installed, OpenSSL now treats it as an indicator that the OpenSSL FIPS module is installed and complete, and the self-tests run whenever the OpenSSL dynamic library is loaded. (BZ#993584, BZ#999867)
  

Users of openssl are advised to upgrade to these updated packages, which fix these bugs and add these enhancements. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.

Solution

Before applying this update, make sure all previously released errata relevant
to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386

Fixes

• BZ - 987411 - Current openssl version does not support 'Next Protocol Negotiation'.
• BZ - 1003922 - openssh update kills sshd daemon with FATAL FIPS SELFTEST FAILURE
• BZ - 1009027 - openssl speed cmd fails on FIPS enabled machine
• BZ - 1009995 - Memory leak in FIPS_selftest_aes_ccm and FIPS_selftest_aes_gcm
• BZ - 1012481 - s_server -dtls1 crashes in FIPS mode

CVEs

(none)

References

(none)

Red Hat Enterprise Linux Server 6

SRPM
openssl-1.0.1e-15.el6.src.rpm	SHA-256: 856e992b500ad88dd2bfe24dc3f7e137f46825970bda935c81e9a14d9be52d04
x86_64
openssl-1.0.1e-15.el6.i686.rpm	SHA-256: 5a7dcb455f5eb86fb6451ffe206b129e21b0ac8f982305a8c29e8e22a961d6a9
openssl-1.0.1e-15.el6.x86_64.rpm	SHA-256: ec741ea9d568bbde2239ab32245685d4632ba20553f544f76f5ca358e73867b4
openssl-debuginfo-1.0.1e-15.el6.i686.rpm	SHA-256: aba7d80b9b4d453a8ae9d935dca4067f149798e17a7681275a21ab06fb92ad9e
openssl-debuginfo-1.0.1e-15.el6.x86_64.rpm	SHA-256: 7939b0825586375fbd85ec11ccf5082503b96330e7aa787713952dc3218ec7e0
openssl-debuginfo-1.0.1e-15.el6.x86_64.rpm	SHA-256: 7939b0825586375fbd85ec11ccf5082503b96330e7aa787713952dc3218ec7e0
openssl-devel-1.0.1e-15.el6.i686.rpm	SHA-256: cb080eefbc26e31341c74d85f5b411aef9516256ce198db3fe3f899ab62f24ed
openssl-devel-1.0.1e-15.el6.x86_64.rpm	SHA-256: a28d4ab16cf23d543a211f52438210fe8c109a0d0afe9606f0d254a37f036ae1
openssl-perl-1.0.1e-15.el6.x86_64.rpm	SHA-256: 57e08d39653d6f641954525653ca73144794f3d2bb6df5111fa0a32925afca96
openssl-static-1.0.1e-15.el6.x86_64.rpm	SHA-256: aaf825cb23fd83057759ccb0b1202a09ef3e00761d199d8100bbc83ab4e60f32
i386
openssl-1.0.1e-15.el6.i686.rpm	SHA-256: 5a7dcb455f5eb86fb6451ffe206b129e21b0ac8f982305a8c29e8e22a961d6a9
openssl-debuginfo-1.0.1e-15.el6.i686.rpm	SHA-256: aba7d80b9b4d453a8ae9d935dca4067f149798e17a7681275a21ab06fb92ad9e
openssl-debuginfo-1.0.1e-15.el6.i686.rpm	SHA-256: aba7d80b9b4d453a8ae9d935dca4067f149798e17a7681275a21ab06fb92ad9e
openssl-devel-1.0.1e-15.el6.i686.rpm	SHA-256: cb080eefbc26e31341c74d85f5b411aef9516256ce198db3fe3f899ab62f24ed
openssl-perl-1.0.1e-15.el6.i686.rpm	SHA-256: 64b29defbf490bd41d6fcbbb8cf1edba23ec33080ec494a52135060d59b16a36
openssl-static-1.0.1e-15.el6.i686.rpm	SHA-256: 576fe28abb24d3d90f629d9b1b5033606849ff2ddaabb0333099607f95375168

Red Hat Enterprise Linux Workstation 6

SRPM
openssl-1.0.1e-15.el6.src.rpm	SHA-256: 856e992b500ad88dd2bfe24dc3f7e137f46825970bda935c81e9a14d9be52d04
x86_64
openssl-1.0.1e-15.el6.i686.rpm	SHA-256: 5a7dcb455f5eb86fb6451ffe206b129e21b0ac8f982305a8c29e8e22a961d6a9
openssl-1.0.1e-15.el6.x86_64.rpm	SHA-256: ec741ea9d568bbde2239ab32245685d4632ba20553f544f76f5ca358e73867b4
openssl-debuginfo-1.0.1e-15.el6.i686.rpm	SHA-256: aba7d80b9b4d453a8ae9d935dca4067f149798e17a7681275a21ab06fb92ad9e
openssl-debuginfo-1.0.1e-15.el6.x86_64.rpm	SHA-256: 7939b0825586375fbd85ec11ccf5082503b96330e7aa787713952dc3218ec7e0
openssl-debuginfo-1.0.1e-15.el6.x86_64.rpm	SHA-256: 7939b0825586375fbd85ec11ccf5082503b96330e7aa787713952dc3218ec7e0
openssl-devel-1.0.1e-15.el6.i686.rpm	SHA-256: cb080eefbc26e31341c74d85f5b411aef9516256ce198db3fe3f899ab62f24ed
openssl-devel-1.0.1e-15.el6.x86_64.rpm	SHA-256: a28d4ab16cf23d543a211f52438210fe8c109a0d0afe9606f0d254a37f036ae1
openssl-perl-1.0.1e-15.el6.x86_64.rpm	SHA-256: 57e08d39653d6f641954525653ca73144794f3d2bb6df5111fa0a32925afca96
openssl-static-1.0.1e-15.el6.x86_64.rpm	SHA-256: aaf825cb23fd83057759ccb0b1202a09ef3e00761d199d8100bbc83ab4e60f32
i386
openssl-1.0.1e-15.el6.i686.rpm	SHA-256: 5a7dcb455f5eb86fb6451ffe206b129e21b0ac8f982305a8c29e8e22a961d6a9
openssl-debuginfo-1.0.1e-15.el6.i686.rpm	SHA-256: aba7d80b9b4d453a8ae9d935dca4067f149798e17a7681275a21ab06fb92ad9e
openssl-debuginfo-1.0.1e-15.el6.i686.rpm	SHA-256: aba7d80b9b4d453a8ae9d935dca4067f149798e17a7681275a21ab06fb92ad9e
openssl-devel-1.0.1e-15.el6.i686.rpm	SHA-256: cb080eefbc26e31341c74d85f5b411aef9516256ce198db3fe3f899ab62f24ed
openssl-perl-1.0.1e-15.el6.i686.rpm	SHA-256: 64b29defbf490bd41d6fcbbb8cf1edba23ec33080ec494a52135060d59b16a36
openssl-static-1.0.1e-15.el6.i686.rpm	SHA-256: 576fe28abb24d3d90f629d9b1b5033606849ff2ddaabb0333099607f95375168

Red Hat Enterprise Linux Desktop 6

SRPM
openssl-1.0.1e-15.el6.src.rpm	SHA-256: 856e992b500ad88dd2bfe24dc3f7e137f46825970bda935c81e9a14d9be52d04
x86_64
openssl-1.0.1e-15.el6.i686.rpm	SHA-256: 5a7dcb455f5eb86fb6451ffe206b129e21b0ac8f982305a8c29e8e22a961d6a9
openssl-1.0.1e-15.el6.x86_64.rpm	SHA-256: ec741ea9d568bbde2239ab32245685d4632ba20553f544f76f5ca358e73867b4
openssl-debuginfo-1.0.1e-15.el6.i686.rpm	SHA-256: aba7d80b9b4d453a8ae9d935dca4067f149798e17a7681275a21ab06fb92ad9e
openssl-debuginfo-1.0.1e-15.el6.i686.rpm	SHA-256: aba7d80b9b4d453a8ae9d935dca4067f149798e17a7681275a21ab06fb92ad9e
openssl-debuginfo-1.0.1e-15.el6.x86_64.rpm	SHA-256: 7939b0825586375fbd85ec11ccf5082503b96330e7aa787713952dc3218ec7e0
openssl-debuginfo-1.0.1e-15.el6.x86_64.rpm	SHA-256: 7939b0825586375fbd85ec11ccf5082503b96330e7aa787713952dc3218ec7e0
openssl-devel-1.0.1e-15.el6.i686.rpm	SHA-256: cb080eefbc26e31341c74d85f5b411aef9516256ce198db3fe3f899ab62f24ed
openssl-devel-1.0.1e-15.el6.x86_64.rpm	SHA-256: a28d4ab16cf23d543a211f52438210fe8c109a0d0afe9606f0d254a37f036ae1
openssl-perl-1.0.1e-15.el6.x86_64.rpm	SHA-256: 57e08d39653d6f641954525653ca73144794f3d2bb6df5111fa0a32925afca96
openssl-static-1.0.1e-15.el6.x86_64.rpm	SHA-256: aaf825cb23fd83057759ccb0b1202a09ef3e00761d199d8100bbc83ab4e60f32
i386
openssl-1.0.1e-15.el6.i686.rpm	SHA-256: 5a7dcb455f5eb86fb6451ffe206b129e21b0ac8f982305a8c29e8e22a961d6a9
openssl-debuginfo-1.0.1e-15.el6.i686.rpm	SHA-256: aba7d80b9b4d453a8ae9d935dca4067f149798e17a7681275a21ab06fb92ad9e
openssl-debuginfo-1.0.1e-15.el6.i686.rpm	SHA-256: aba7d80b9b4d453a8ae9d935dca4067f149798e17a7681275a21ab06fb92ad9e
openssl-devel-1.0.1e-15.el6.i686.rpm	SHA-256: cb080eefbc26e31341c74d85f5b411aef9516256ce198db3fe3f899ab62f24ed
openssl-perl-1.0.1e-15.el6.i686.rpm	SHA-256: 64b29defbf490bd41d6fcbbb8cf1edba23ec33080ec494a52135060d59b16a36
openssl-static-1.0.1e-15.el6.i686.rpm	SHA-256: 576fe28abb24d3d90f629d9b1b5033606849ff2ddaabb0333099607f95375168

Red Hat Enterprise Linux for IBM z Systems 6

SRPM
openssl-1.0.1e-15.el6.src.rpm	SHA-256: 856e992b500ad88dd2bfe24dc3f7e137f46825970bda935c81e9a14d9be52d04
s390x
openssl-1.0.1e-15.el6.s390.rpm	SHA-256: 0a528d729bac4452a6bc5ee8ce1a1b8d439a3a31872fb5b97682f77de98bc61d
openssl-1.0.1e-15.el6.s390x.rpm	SHA-256: 29beda2b4612386f500379df9e45d4942c6ed9c358620e8457ab82972c771a09
openssl-debuginfo-1.0.1e-15.el6.s390.rpm	SHA-256: d4ec44f5a16d26de380c48c25646f90aa14f2441ea503ad54c694244f84dc38e
openssl-debuginfo-1.0.1e-15.el6.s390x.rpm	SHA-256: cc2c7c79820bf30a8a987f1aa1de1db61888134987b48e64e672828baa6ff550
openssl-debuginfo-1.0.1e-15.el6.s390x.rpm	SHA-256: cc2c7c79820bf30a8a987f1aa1de1db61888134987b48e64e672828baa6ff550
openssl-devel-1.0.1e-15.el6.s390.rpm	SHA-256: d611dae9d967c07413fe92a07c9cf26008b459e201fd27de4b67fe78f06e6706
openssl-devel-1.0.1e-15.el6.s390x.rpm	SHA-256: 0d9b3b901020748685e7309ce02e5f125eadd40540c440c8ab0e25317093644d
openssl-perl-1.0.1e-15.el6.s390x.rpm	SHA-256: 1454b15ab086dcf32ef8312a0501372fe27128061f4c6cb4e3b83ad73e7598e2
openssl-static-1.0.1e-15.el6.s390x.rpm	SHA-256: 57aa54a0074b0980012f6710aa52343fcd10934142c1ffef97eb40379f5c2bff

Red Hat Enterprise Linux for Power, big endian 6

SRPM
openssl-1.0.1e-15.el6.src.rpm	SHA-256: 856e992b500ad88dd2bfe24dc3f7e137f46825970bda935c81e9a14d9be52d04
ppc64
openssl-1.0.1e-15.el6.ppc.rpm	SHA-256: c3583c132c08b6d1b5de299b59cbbd3224d214fcd9b7ddf8f3b24deed44f3ae6
openssl-1.0.1e-15.el6.ppc64.rpm	SHA-256: 367fff1ebb86ac2bb5e4cbfe5b01aa026f7a94ce308af44352af732d769a9817
openssl-debuginfo-1.0.1e-15.el6.ppc.rpm	SHA-256: 012dd307935e66d420dff81b6ac6257b436fb5daa2aff1e38380d1edbf0c8c66
openssl-debuginfo-1.0.1e-15.el6.ppc64.rpm	SHA-256: a72e249632998696a2a84ec735370f5f79f6ae51a6a8cb2d79e240a1963cb429
openssl-debuginfo-1.0.1e-15.el6.ppc64.rpm	SHA-256: a72e249632998696a2a84ec735370f5f79f6ae51a6a8cb2d79e240a1963cb429
openssl-devel-1.0.1e-15.el6.ppc.rpm	SHA-256: 11941768ea97336d268b8dbcd4e3ab7b57dc0226593576382217512b0dde37e9
openssl-devel-1.0.1e-15.el6.ppc64.rpm	SHA-256: 6b10dcea3f4e32b8c97ab56570f2c9e16b11ab9c25b1f462cf2700d736375de1
openssl-perl-1.0.1e-15.el6.ppc64.rpm	SHA-256: d6f27b26708a22a73ba0ece188325906953d3d2c314428cfa040880602153d1c
openssl-static-1.0.1e-15.el6.ppc64.rpm	SHA-256: fac8448d468f67284841e22cd42e8f88d10b7bd300bd53d86d9f38268f512f1a

Red Hat Enterprise Linux for Scientific Computing 6

SRPM
openssl-1.0.1e-15.el6.src.rpm	SHA-256: 856e992b500ad88dd2bfe24dc3f7e137f46825970bda935c81e9a14d9be52d04
x86_64
openssl-1.0.1e-15.el6.i686.rpm	SHA-256: 5a7dcb455f5eb86fb6451ffe206b129e21b0ac8f982305a8c29e8e22a961d6a9
openssl-1.0.1e-15.el6.x86_64.rpm	SHA-256: ec741ea9d568bbde2239ab32245685d4632ba20553f544f76f5ca358e73867b4
openssl-debuginfo-1.0.1e-15.el6.i686.rpm	SHA-256: aba7d80b9b4d453a8ae9d935dca4067f149798e17a7681275a21ab06fb92ad9e
openssl-debuginfo-1.0.1e-15.el6.i686.rpm	SHA-256: aba7d80b9b4d453a8ae9d935dca4067f149798e17a7681275a21ab06fb92ad9e
openssl-debuginfo-1.0.1e-15.el6.x86_64.rpm	SHA-256: 7939b0825586375fbd85ec11ccf5082503b96330e7aa787713952dc3218ec7e0
openssl-debuginfo-1.0.1e-15.el6.x86_64.rpm	SHA-256: 7939b0825586375fbd85ec11ccf5082503b96330e7aa787713952dc3218ec7e0
openssl-devel-1.0.1e-15.el6.i686.rpm	SHA-256: cb080eefbc26e31341c74d85f5b411aef9516256ce198db3fe3f899ab62f24ed
openssl-devel-1.0.1e-15.el6.x86_64.rpm	SHA-256: a28d4ab16cf23d543a211f52438210fe8c109a0d0afe9606f0d254a37f036ae1
openssl-perl-1.0.1e-15.el6.x86_64.rpm	SHA-256: 57e08d39653d6f641954525653ca73144794f3d2bb6df5111fa0a32925afca96
openssl-static-1.0.1e-15.el6.x86_64.rpm	SHA-256: aaf825cb23fd83057759ccb0b1202a09ef3e00761d199d8100bbc83ab4e60f32

Red Hat Enterprise Linux Server from RHUI 6

SRPM
openssl-1.0.1e-15.el6.src.rpm	SHA-256: 856e992b500ad88dd2bfe24dc3f7e137f46825970bda935c81e9a14d9be52d04
x86_64
openssl-1.0.1e-15.el6.i686.rpm	SHA-256: 5a7dcb455f5eb86fb6451ffe206b129e21b0ac8f982305a8c29e8e22a961d6a9
openssl-1.0.1e-15.el6.x86_64.rpm	SHA-256: ec741ea9d568bbde2239ab32245685d4632ba20553f544f76f5ca358e73867b4
openssl-debuginfo-1.0.1e-15.el6.i686.rpm	SHA-256: aba7d80b9b4d453a8ae9d935dca4067f149798e17a7681275a21ab06fb92ad9e
openssl-debuginfo-1.0.1e-15.el6.x86_64.rpm	SHA-256: 7939b0825586375fbd85ec11ccf5082503b96330e7aa787713952dc3218ec7e0
openssl-debuginfo-1.0.1e-15.el6.x86_64.rpm	SHA-256: 7939b0825586375fbd85ec11ccf5082503b96330e7aa787713952dc3218ec7e0
openssl-devel-1.0.1e-15.el6.i686.rpm	SHA-256: cb080eefbc26e31341c74d85f5b411aef9516256ce198db3fe3f899ab62f24ed
openssl-devel-1.0.1e-15.el6.x86_64.rpm	SHA-256: a28d4ab16cf23d543a211f52438210fe8c109a0d0afe9606f0d254a37f036ae1
openssl-perl-1.0.1e-15.el6.x86_64.rpm	SHA-256: 57e08d39653d6f641954525653ca73144794f3d2bb6df5111fa0a32925afca96
openssl-static-1.0.1e-15.el6.x86_64.rpm	SHA-256: aaf825cb23fd83057759ccb0b1202a09ef3e00761d199d8100bbc83ab4e60f32
i386
openssl-1.0.1e-15.el6.i686.rpm	SHA-256: 5a7dcb455f5eb86fb6451ffe206b129e21b0ac8f982305a8c29e8e22a961d6a9
openssl-debuginfo-1.0.1e-15.el6.i686.rpm	SHA-256: aba7d80b9b4d453a8ae9d935dca4067f149798e17a7681275a21ab06fb92ad9e
openssl-debuginfo-1.0.1e-15.el6.i686.rpm	SHA-256: aba7d80b9b4d453a8ae9d935dca4067f149798e17a7681275a21ab06fb92ad9e
openssl-devel-1.0.1e-15.el6.i686.rpm	SHA-256: cb080eefbc26e31341c74d85f5b411aef9516256ce198db3fe3f899ab62f24ed
openssl-perl-1.0.1e-15.el6.i686.rpm	SHA-256: 64b29defbf490bd41d6fcbbb8cf1edba23ec33080ec494a52135060d59b16a36
openssl-static-1.0.1e-15.el6.i686.rpm	SHA-256: 576fe28abb24d3d90f629d9b1b5033606849ff2ddaabb0333099607f95375168