- Vulnerability/
- RHSA-2009:0004
RHSA-2009:0004: Important: openssl security update
First published: Wed Jan 07 2009(Updated: )
OpenSSL is a toolkit that implements Secure Sockets Layer (SSL v2/v3) and<br>Transport Layer Security (TLS v1) protocols as well as a full-strength,<br>general purpose, cryptography library.<br>The Google security team discovered a flaw in the way OpenSSL checked the<br>verification of certificates. An attacker in control of a malicious server,<br>or able to effect a "man in the middle" attack, could present a malformed<br>SSL/TLS signature from a certificate chain to a vulnerable client and<br>bypass validation. (CVE-2008-5077)<br>All OpenSSL users should upgrade to these updated packages, which contain<br>backported patches to resolve these issues. For the update to take effect,<br>all running OpenSSL client applications must be restarted, or the system<br>rebooted.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/openssl | <0.9.8b-10.el5_2.1 | 0.9.8b-10.el5_2.1 |
| redhat/openssl | <0.9.8b-10.el5_2.1 | 0.9.8b-10.el5_2.1 |
| redhat/openssl-devel | <0.9.8b-10.el5_2.1 | 0.9.8b-10.el5_2.1 |
| redhat/openssl-devel | <0.9.8b-10.el5_2.1 | 0.9.8b-10.el5_2.1 |
| redhat/openssl-perl | <0.9.8b-10.el5_2.1 | 0.9.8b-10.el5_2.1 |
| redhat/openssl097a | <0.9.7a-9.el5_2.1 | 0.9.7a-9.el5_2.1 |
| redhat/openssl097a | <0.9.7a-9.el5_2.1 | 0.9.7a-9.el5_2.1 |
| redhat/openssl-perl | <0.9.8b-10.el5_2.1 | 0.9.8b-10.el5_2.1 |
| redhat/openssl | <0.9.7a-43.17.el4_7.2 | 0.9.7a-43.17.el4_7.2 |
| redhat/openssl | <0.9.7a-43.17.el4_7.2 | 0.9.7a-43.17.el4_7.2 |
| redhat/openssl-devel | <0.9.7a-43.17.el4_7.2 | 0.9.7a-43.17.el4_7.2 |
| redhat/openssl-devel | <0.9.7a-43.17.el4_7.2 | 0.9.7a-43.17.el4_7.2 |
| redhat/openssl-perl | <0.9.7a-43.17.el4_7.2 | 0.9.7a-43.17.el4_7.2 |
| redhat/openssl096b | <0.9.6b-22.46.el4_7 | 0.9.6b-22.46.el4_7 |
| redhat/openssl096b | <0.9.6b-22.46.el4_7 | 0.9.6b-22.46.el4_7 |
| redhat/openssl-perl | <0.9.7a-43.17.el4_7.2 | 0.9.7a-43.17.el4_7.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2009:0004
- agent/software-canonical-lookup
- package-manager/redhat