RHSA-2009:0004: Important: openssl security update
OpenSSL is a toolkit that implements Secure Sockets Layer (SSL v2/v3) andTransport Layer Security (TLS v1) protocols as well as a full-strength,general purpose, cryptography library.The Google security team discovered a flaw in the way OpenSSL checked theverification of certificates. An attacker in control of a malicious server,or able to effect a "man in the middle" attack, could present a malformedSSL/TLS signature from a certificate chain to a vulnerable client andbypass validation. (CVE-2008-5077)All OpenSSL users should upgrade to these updated packages, which containbackported patches to resolve these issues. For the update to take effect,all running OpenSSL client applications must be restarted, or the systemrebooted.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2009:0004?
The severity of RHSA-2009:0004 is classified as important.
How do I fix RHSA-2009:0004?
To fix RHSA-2009:0004, upgrade to the patched versions of affected OpenSSL packages as specified in the advisory.
What software is affected by RHSA-2009:0004?
RHSA-2009:0004 affects various versions of OpenSSL, including 0.9.8b-10.el5_2.1 and 0.9.7a-43.17.el4_7.2.
What is the nature of the vulnerability in RHSA-2009:0004?
The vulnerability in RHSA-2009:0004 is related to improper verification processes in OpenSSL.
Where can I find more details about RHSA-2009:0004?
Detailed information about RHSA-2009:0004 can be found in the Red Hat security advisory.