RHSA-2015:0066: Moderate: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL),Transport Layer Security (TLS), and Datagram Transport Layer Security(DTLS) protocols, as well as a full-strength, general purpose cryptographylibrary.A NULL pointer dereference flaw was found in the DTLS implementation ofOpenSSL. A remote attacker could send a specially crafted DTLS message,which would cause an OpenSSL server to crash. (CVE-2014-3571)A memory leak flaw was found in the way the dtls1bufferrecord() functionof OpenSSL parsed certain DTLS messages. A remote attacker could sendmultiple specially crafted DTLS messages to exhaust all available memory ofa DTLS server. (CVE-2015-0206)It was found that OpenSSL's BigNumber Squaring implementation could produceincorrect results under certain special conditions. This flaw couldpossibly affect certain OpenSSL library functionality, such as RSAblinding. Note that this issue occurred rarely and with a low probability,and there is currently no known way of exploiting it. (CVE-2014-3570)It was discovered that OpenSSL would perform an ECDH key exchange with anon-ephemeral key even when the ephemeral ECDH cipher suite was selected.A malicious server could make a TLS/SSL client using OpenSSL use a weakerkey exchange method than the one requested by the user. (CVE-2014-3572)It was discovered that OpenSSL would accept ephemeral RSA keys when usingnon-export RSA cipher suites. A malicious server could make a TLS/SSLclient using OpenSSL use a weaker key exchange method. (CVE-2015-0204)Multiple flaws were found in the way OpenSSL parsed X.509 certificates.An attacker could use these flaws to modify an X.509 certificate to producea certificate with a different fingerprint without invalidating itssignature, and possibly bypass fingerprint-based blacklisting inapplications. (CVE-2014-8275)It was found that an OpenSSL server would, under certain conditions, acceptDiffie-Hellman client certificates without the use of a private key.An attacker could use a user's client certificate to authenticate as thatuser, without needing the private key. (CVE-2015-0205)All OpenSSL users are advised to upgrade to these updated packages, whichcontain a backported patch to mitigate the above issues. For the update totake effect, all services linked to the OpenSSL library (such as httpd andother SSL-enabled services) must be restarted or the system rebooted.