CVE-2015-0293

Impact:
Moderate
Public Date:
2015-03-19
CWE:
CWE-617
Bugzilla:
1202404: CVE-2015-0293 openssl: assertion failure in SSLv2 servers
A denial of service flaw was found in the way OpenSSL handled SSLv2 handshake messages. A remote attacker could use this flaw to cause a TLS/SSL server using OpenSSL to exit on a failed assertion if it had both the SSLv2 protocol and EXPORT-grade cipher suites enabled.

Find out more about CVE-2015-0293 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v2 metrics

Base Score 4.3
Base Metrics AV:N/AC:M/Au:N/C:N/I:N/A:P
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Partial

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat Enterprise Linux Advanced Update Support 6.5 (openssl) RHSA-2016:0303 2016-03-01
Red Hat Enterprise Linux Advanced Update Support 6.2 (openssl) RHSA-2016:0303 2016-03-01
Red Hat Enterprise Linux Long Life (v. 5.9 server) (openssl) RHSA-2016:0304 2016-03-01
Red Hat Enterprise Linux Extended Lifecycle Support 4 (openssl) RHSA-2016:0306 2016-03-01
Red Hat Enterprise Linux 6 (openssl) RHSA-2015:0715 2015-03-23
Red Hat Enterprise Linux Long Life (v. 5.6 server) (openssl) RHSA-2016:0304 2016-03-01
Red Hat JBoss Enterprise Application Platform 6.4 RHSA-2016:0490 2016-03-22
Red Hat JBoss Web Server 2.1 RHSA-2016:0445 2016-03-14
Red Hat Storage Server 2.1 (openssl) RHSA-2015:0752 2015-03-30
Red Hat JBoss Web Server 3.0 RHSA-2016:0446 2016-03-14
Red Hat Enterprise Linux Advanced Update Support 6.4 (openssl) RHSA-2016:0303 2016-03-01
Red Hat Enterprise Linux 5 (openssl) RHSA-2015:0800 2015-04-13
Red Hat Enterprise Linux 7 (openssl) RHSA-2015:0716 2015-03-23
Red Hat Enterprise Linux 7 (openssl098e) RHSA-2016:0372 2016-03-09
Red Hat Enterprise Linux 6 (openssl098e) RHSA-2016:0372 2016-03-09

Affected Packages State

Platform Package State
Red Hat JBoss EWS 1 openssl Will not fix
Red Hat JBoss EAP 5 openssl Will not fix
Red Hat Enterprise Linux 5 openssl097a Will not fix
RHEV-M for Servers mingw-virt-viewer Will not fix

Acknowledgements

Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges Sean Burford (Google) and Emilia Käsper (the OpenSSL development team) as the original reporters.

External References

Last Modified
Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.