RHSA-2010:0162: Important: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3)and Transport Layer Security (TLS v1) protocols, as well as afull-strength, general purpose cryptography library.It was discovered that OpenSSL did not always check the return value of thebnwexpand() function. An attacker able to trigger a memory allocationfailure in that function could cause an application using the OpenSSLlibrary to crash or, possibly, execute arbitrary code. (CVE-2009-3245)A flaw was found in the way the TLS/SSL (Transport Layer Security/SecureSockets Layer) protocols handled session renegotiation. A man-in-the-middleattacker could use this flaw to prefix arbitrary plain text to a client'ssession (for example, an HTTPS connection to a website). This could forcethe server to process an attacker's request as if authenticated using thevictim's credentials. This update addresses this flaw by implementing theTLS Renegotiation Indication Extension, as defined in RFC 5746.(CVE-2009-3555)Refer to the following Knowledgebase article for additional details aboutthe CVE-2009-3555 flaw: http://kbase.redhat.com/faq/docs/DOC-20491 A missing return value check flaw was discovered in OpenSSL, that couldpossibly cause OpenSSL to call a Kerberos library function with invalidarguments, resulting in a NULL pointer dereference crash in the MITKerberos library. In certain configurations, a remote attacker could usethis flaw to crash a TLS/SSL server using OpenSSL by requesting Kerberoscipher suites during the TLS handshake. (CVE-2010-0433)All OpenSSL users should upgrade to these updated packages, which containbackported patches to resolve these issues. For the update to take effect,all services linked to the OpenSSL library must be restarted, or the systemrebooted.