REDHAT-BUG-1072180
First published: Tue Mar 04 2014(Updated: )
A flaw was found in the way stunnel, a socket wrapper which can provide SSL support to ordinary applications, performed (re)initialization of PRNG after fork. When accepting a new connection, the server forks and the child process handles the request. The RAND_bytes() function of openssl doesn't reset its state after the fork, but seeds the PRNG with the output of time(NULL). The most important consequence is that servers using EC (ECDSA) or DSA certificates may under certain conditions leak their private key.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| stunnel | ||
| OpenSSL |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-1072180?
The severity of REDHAT-BUG-1072180 is classified as important due to potential issues in SSL support and random number generation.
How do I fix REDHAT-BUG-1072180?
To fix REDHAT-BUG-1072180, update your stunnel and OpenSSL packages to the latest version where the mentioned flaw has been addressed.
What products are affected by REDHAT-BUG-1072180?
The products affected by REDHAT-BUG-1072180 include stunnel and OpenSSL.
What is the risk of leaving REDHAT-BUG-1072180 unaddressed?
Leaving REDHAT-BUG-1072180 unaddressed may lead to security vulnerabilities in SSL connections, exposing sensitive data.
Is there a workaround for REDHAT-BUG-1072180?
While the best solution is to apply updates, a possible workaround for REDHAT-BUG-1072180 is to limit the usage of forked processes in SSL context handling.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2014-0016
- agent/severity
- agent/event
- agent/description
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/stunnel
- canonical/stunnel
- vendor/openssl
- canonical/openssl