RHBA-2015:0026 - Bug Fix Advisory

Topic

Updated openssl packages that fix one bug are now available for Red Hat
Enterprise Linux 5.

Description

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and
Transport Layer Security (TLS) protocols, as well as a full-strength
general-purpose cryptography library.

This update fixes the following bug:

• Prior to this update, the certificate store access in the OpenSSL library was

not properly locked against simultaneous accesses in multithreaded applications.
As a consequence, the httpd daemon running in multithreaded mode could break the
https service when two threads accessed the certificate store simultaneously.
With this update, the certificate store access in OpenSSL is now locked
properly, and the httpd daemon providing the https service can now properly work
in the described situation. (BZ#1168938)

Users of openssl are advised to upgrade to these updated packages, which fix
this bug. For the update to take effect, all services linked to the OpenSSL
library must be restarted, or the system rebooted.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 1168938 - X509_STORE_get_by_subject() and thus also SSL_Accept() are not thread safe

CVEs

(none)

References

(none)