OpenSSL CCS Injection Detector
About
This tool checks to determine if the version of OpenSSL used by services running on a RHEL system is patched for the OpenSSL CCS Injection vulnerability (CVE-2014-0224).
Can this app false positive?
Yes -- OpenSSL server versions pre 1.0.1 may fail the vulnerability test even though they can not be exploited (clients pre 1.0.1 are still vulnerable, but this tool does not scan clients). This application checks to make sure that the patch for CVE-2014-0224 was properly applied regardless of whether the OpenSSL lib was vulnerable in the first place.
Was this helpful?
We appreciate your feedback. Leave a comment if you would like to provide more detail.
It looks like we have some work to do. Leave a comment to let us know how we could improve.
Close
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.