Issued:
2016-05-31
Updated:
2016-05-31

RHSA-2016:1137 - Security Advisory

Synopsis

Important: openssl security update

Type/Severity

Security Advisory: Important

Topic

An update for openssl is now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives
a detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

Description

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and
Transport Layer Security (TLS) protocols, as well as a full-strength
general-purpose cryptography library.

Security Fix(es):

  • A flaw was found in the way OpenSSL encoded certain ASN.1 data structures. An
    attacker could use this flaw to create a specially crafted certificate which,
    when verified or re-encoded by OpenSSL, could cause it to crash, or execute
    arbitrary code using the permissions of the user running an application compiled
    against the OpenSSL library. (CVE-2016-2108)

Red Hat would like to thank the OpenSSL project for reporting this issue.
Upstream acknowledges Huzaifa Sidhpurwala (Red Hat), Hanno Bock, and David
Benjamin (Google) as the original reporters.

Solution

For details on how to apply this update, which includes the changes described in
this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all services linked to the OpenSSL library must
be restarted, or the system rebooted.

Affected Products

  • Red Hat Enterprise Linux Server 5 x86_64
  • Red Hat Enterprise Linux Server 5 ia64
  • Red Hat Enterprise Linux Server 5 i386
  • Red Hat Enterprise Linux Workstation 5 x86_64
  • Red Hat Enterprise Linux Workstation 5 i386
  • Red Hat Enterprise Linux Desktop 5 x86_64
  • Red Hat Enterprise Linux Desktop 5 i386
  • Red Hat Enterprise Linux for IBM z Systems 5 s390x
  • Red Hat Enterprise Linux for Power, big endian 5 ppc

Fixes

  • BZ - 1331402 - CVE-2016-2108 openssl: Memory corruption in the ASN.1 encoder

CVEs

References

Red Hat Enterprise Linux Server 5

SRPM
openssl-0.9.8e-40.el5_11.src.rpm SHA-256: fb946de35627c788afdc3b58e0e8f41508b774444097ecdc0fbffaede05d18c4
x86_64
openssl-0.9.8e-40.el5_11.i686.rpm SHA-256: 83969318bbe56c2fe1adcf6c53e9da9d0a059295cf5b78d4a1c5e3e64f9fcd2a
openssl-0.9.8e-40.el5_11.x86_64.rpm SHA-256: 09d4a4241a4754a7b565da41460e82e816cc2f5c1a960cf99071552d054cfe87
openssl-debuginfo-0.9.8e-40.el5_11.i386.rpm SHA-256: 3671ff7a77d7704ea638fcc75b92732ac3fa2fe653c7f9c5984bb58a8e3cad39
openssl-debuginfo-0.9.8e-40.el5_11.i686.rpm SHA-256: acfbe297842e5d08229dd5f7b45bc68cca47332e9317f8e7e1f76893295527df
openssl-debuginfo-0.9.8e-40.el5_11.x86_64.rpm SHA-256: a51d88aac389b927cbec39059884b9350f190fd0b7859f4f6bf77446e842a273
openssl-devel-0.9.8e-40.el5_11.i386.rpm SHA-256: 5c1c3e4c2276202fdd63ba2a226c1551c49686594cc43c4b0a390b675f28103c
openssl-devel-0.9.8e-40.el5_11.x86_64.rpm SHA-256: fcd13a11a9c6c1a89d8885a918f008a1bd43631a8599d0410e7f24af747e4c23
openssl-perl-0.9.8e-40.el5_11.x86_64.rpm SHA-256: 3d2769e614a59cfc9cdc241d95b2733df4fbfa76637a97ff4453d7d9e35f5308
ia64
openssl-0.9.8e-40.el5_11.i686.rpm SHA-256: 83969318bbe56c2fe1adcf6c53e9da9d0a059295cf5b78d4a1c5e3e64f9fcd2a
openssl-0.9.8e-40.el5_11.ia64.rpm SHA-256: 06e64194533746a1c9d0c5649dd16574acba9e8c512292c5d866cac9fb633053
openssl-debuginfo-0.9.8e-40.el5_11.i686.rpm SHA-256: acfbe297842e5d08229dd5f7b45bc68cca47332e9317f8e7e1f76893295527df
openssl-debuginfo-0.9.8e-40.el5_11.ia64.rpm SHA-256: 1a065095a140fedfd12674c9b98591534e7480d815bf5a200a9548b4cbd58502
openssl-devel-0.9.8e-40.el5_11.ia64.rpm SHA-256: f22ba9b29412abf653817032e3247107d45f21c73146f95d2a14af5b658df280
openssl-perl-0.9.8e-40.el5_11.ia64.rpm SHA-256: a3b330ce20c53def2fe5f0da59b5e3df4beccdc6b988e87bdc777d9ca4d21ccb
i386
openssl-0.9.8e-40.el5_11.i386.rpm SHA-256: 520005924c7b6a266b0ff246edae032c274334c9f6556e881452943fc4d94f69
openssl-0.9.8e-40.el5_11.i686.rpm SHA-256: 83969318bbe56c2fe1adcf6c53e9da9d0a059295cf5b78d4a1c5e3e64f9fcd2a
openssl-debuginfo-0.9.8e-40.el5_11.i386.rpm SHA-256: 3671ff7a77d7704ea638fcc75b92732ac3fa2fe653c7f9c5984bb58a8e3cad39
openssl-debuginfo-0.9.8e-40.el5_11.i686.rpm SHA-256: acfbe297842e5d08229dd5f7b45bc68cca47332e9317f8e7e1f76893295527df
openssl-devel-0.9.8e-40.el5_11.i386.rpm SHA-256: 5c1c3e4c2276202fdd63ba2a226c1551c49686594cc43c4b0a390b675f28103c
openssl-perl-0.9.8e-40.el5_11.i386.rpm SHA-256: d3fd3ece75d8c33a0233731e81cc43aaa090f99cb85331b1e4dbbdc46a5709b2

Red Hat Enterprise Linux Workstation 5

SRPM
openssl-0.9.8e-40.el5_11.src.rpm SHA-256: fb946de35627c788afdc3b58e0e8f41508b774444097ecdc0fbffaede05d18c4
x86_64
openssl-0.9.8e-40.el5_11.i686.rpm SHA-256: 83969318bbe56c2fe1adcf6c53e9da9d0a059295cf5b78d4a1c5e3e64f9fcd2a
openssl-0.9.8e-40.el5_11.x86_64.rpm SHA-256: 09d4a4241a4754a7b565da41460e82e816cc2f5c1a960cf99071552d054cfe87
openssl-debuginfo-0.9.8e-40.el5_11.i386.rpm SHA-256: 3671ff7a77d7704ea638fcc75b92732ac3fa2fe653c7f9c5984bb58a8e3cad39
openssl-debuginfo-0.9.8e-40.el5_11.i686.rpm SHA-256: acfbe297842e5d08229dd5f7b45bc68cca47332e9317f8e7e1f76893295527df
openssl-debuginfo-0.9.8e-40.el5_11.x86_64.rpm SHA-256: a51d88aac389b927cbec39059884b9350f190fd0b7859f4f6bf77446e842a273
openssl-debuginfo-0.9.8e-40.el5_11.x86_64.rpm SHA-256: a51d88aac389b927cbec39059884b9350f190fd0b7859f4f6bf77446e842a273
openssl-devel-0.9.8e-40.el5_11.i386.rpm SHA-256: 5c1c3e4c2276202fdd63ba2a226c1551c49686594cc43c4b0a390b675f28103c
openssl-devel-0.9.8e-40.el5_11.x86_64.rpm SHA-256: fcd13a11a9c6c1a89d8885a918f008a1bd43631a8599d0410e7f24af747e4c23
openssl-perl-0.9.8e-40.el5_11.x86_64.rpm SHA-256: 3d2769e614a59cfc9cdc241d95b2733df4fbfa76637a97ff4453d7d9e35f5308
i386
openssl-0.9.8e-40.el5_11.i386.rpm SHA-256: 520005924c7b6a266b0ff246edae032c274334c9f6556e881452943fc4d94f69
openssl-0.9.8e-40.el5_11.i686.rpm SHA-256: 83969318bbe56c2fe1adcf6c53e9da9d0a059295cf5b78d4a1c5e3e64f9fcd2a
openssl-debuginfo-0.9.8e-40.el5_11.i386.rpm SHA-256: 3671ff7a77d7704ea638fcc75b92732ac3fa2fe653c7f9c5984bb58a8e3cad39
openssl-debuginfo-0.9.8e-40.el5_11.i386.rpm SHA-256: 3671ff7a77d7704ea638fcc75b92732ac3fa2fe653c7f9c5984bb58a8e3cad39
openssl-debuginfo-0.9.8e-40.el5_11.i686.rpm SHA-256: acfbe297842e5d08229dd5f7b45bc68cca47332e9317f8e7e1f76893295527df
openssl-devel-0.9.8e-40.el5_11.i386.rpm SHA-256: 5c1c3e4c2276202fdd63ba2a226c1551c49686594cc43c4b0a390b675f28103c
openssl-perl-0.9.8e-40.el5_11.i386.rpm SHA-256: d3fd3ece75d8c33a0233731e81cc43aaa090f99cb85331b1e4dbbdc46a5709b2

Red Hat Enterprise Linux Desktop 5

SRPM
openssl-0.9.8e-40.el5_11.src.rpm SHA-256: fb946de35627c788afdc3b58e0e8f41508b774444097ecdc0fbffaede05d18c4
x86_64
openssl-0.9.8e-40.el5_11.i686.rpm SHA-256: 83969318bbe56c2fe1adcf6c53e9da9d0a059295cf5b78d4a1c5e3e64f9fcd2a
openssl-0.9.8e-40.el5_11.x86_64.rpm SHA-256: 09d4a4241a4754a7b565da41460e82e816cc2f5c1a960cf99071552d054cfe87
openssl-debuginfo-0.9.8e-40.el5_11.i686.rpm SHA-256: acfbe297842e5d08229dd5f7b45bc68cca47332e9317f8e7e1f76893295527df
openssl-debuginfo-0.9.8e-40.el5_11.x86_64.rpm SHA-256: a51d88aac389b927cbec39059884b9350f190fd0b7859f4f6bf77446e842a273
openssl-perl-0.9.8e-40.el5_11.x86_64.rpm SHA-256: 3d2769e614a59cfc9cdc241d95b2733df4fbfa76637a97ff4453d7d9e35f5308
i386
openssl-0.9.8e-40.el5_11.i386.rpm SHA-256: 520005924c7b6a266b0ff246edae032c274334c9f6556e881452943fc4d94f69
openssl-0.9.8e-40.el5_11.i686.rpm SHA-256: 83969318bbe56c2fe1adcf6c53e9da9d0a059295cf5b78d4a1c5e3e64f9fcd2a
openssl-debuginfo-0.9.8e-40.el5_11.i386.rpm SHA-256: 3671ff7a77d7704ea638fcc75b92732ac3fa2fe653c7f9c5984bb58a8e3cad39
openssl-debuginfo-0.9.8e-40.el5_11.i686.rpm SHA-256: acfbe297842e5d08229dd5f7b45bc68cca47332e9317f8e7e1f76893295527df
openssl-perl-0.9.8e-40.el5_11.i386.rpm SHA-256: d3fd3ece75d8c33a0233731e81cc43aaa090f99cb85331b1e4dbbdc46a5709b2

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
openssl-0.9.8e-40.el5_11.src.rpm SHA-256: fb946de35627c788afdc3b58e0e8f41508b774444097ecdc0fbffaede05d18c4
s390x
openssl-0.9.8e-40.el5_11.s390.rpm SHA-256: 2b5a3975d53590bc666bc2a9ee873ba7a2de19abc73c6b75d43fcb37d99fa1ed
openssl-0.9.8e-40.el5_11.s390x.rpm SHA-256: 639cd1613bbb0b55edbda58cfffa65e8b9360d418ff017d767484bc979e0b16a
openssl-debuginfo-0.9.8e-40.el5_11.s390.rpm SHA-256: 81367fdbb02f18bf3e06d433ebc392ead3689f7ab3788729bc4bb60c9cefdb05
openssl-debuginfo-0.9.8e-40.el5_11.s390x.rpm SHA-256: 0330c17b0a139f89e319886a6ca361e9a62a84cc1bf963730574d9a72d3aff96
openssl-devel-0.9.8e-40.el5_11.s390.rpm SHA-256: e98d30627dedac33c2a4f18ade472ecaeda5f9013bb234ad1ddc7de7355acc05
openssl-devel-0.9.8e-40.el5_11.s390x.rpm SHA-256: 6985b77991eca8472e8ffb9b430fc1e33b5c07dc1ee8d0eaaeadbaf93598a555
openssl-perl-0.9.8e-40.el5_11.s390x.rpm SHA-256: 8b4b88501a1b3114d536ec34867ff908644fe06ed6a568b36d46bfd66d097643

Red Hat Enterprise Linux for Power, big endian 5

SRPM
openssl-0.9.8e-40.el5_11.src.rpm SHA-256: fb946de35627c788afdc3b58e0e8f41508b774444097ecdc0fbffaede05d18c4
ppc
openssl-0.9.8e-40.el5_11.ppc.rpm SHA-256: 6abde53d21380e0bcc12a0a49452e4c8d26b35bb176b46a3475641033a94cbba
openssl-0.9.8e-40.el5_11.ppc64.rpm SHA-256: fd18db27c3e87e5faa759e2410fbc009c0199544c5829af98c5163d50276364c
openssl-debuginfo-0.9.8e-40.el5_11.ppc.rpm SHA-256: aa76882d36633dfffb6ef4f14174e9698ee40fabdd823b3e891868578226c936
openssl-debuginfo-0.9.8e-40.el5_11.ppc64.rpm SHA-256: 2a40c81ba3cadb1040db08a2005f54369c761171fcf3e45012db7dfc672723c5
openssl-devel-0.9.8e-40.el5_11.ppc.rpm SHA-256: e592447d0b6b5aea215168dad333c94313bd53c38aff65f4ebd37ad1e0b6e67d
openssl-devel-0.9.8e-40.el5_11.ppc64.rpm SHA-256: c5506044e9a289b72e3e3876ca411a759320dc1bc61b6ac0b83c6186aad176ee
openssl-perl-0.9.8e-40.el5_11.ppc.rpm SHA-256: d729a4c2233be27377bb84b107a4de1b5bcbb45b9b302465b55c7f979c79730a

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.