<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi Michael,<div class=""><br class=""></div><div class="">Thanks for all the great info! I’ll check again next week to see if the updates came through.<br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; " class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; " class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; " class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; " class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; " class=""><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; " class=""><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div style="font-weight: normal; " class=""><br class="Apple-interchange-newline">--</div><div class=""><b class="">Matt James</b></div><div style="font-weight: normal; " class=""><a href="http://rainstorminc.com" class="">RainStorm, Inc</a></div><div style="font-weight: normal; " class="">(207) 866-3908 x54</div></span></div></span></div></div></div></div></div>
</div>
<br class=""><div><blockquote type="cite" class=""><div class="">On Dec 7, 2015, at 12:22 PM, Michael Stauber <<a href="mailto:mstauber@blueonyx.it" class="">mstauber@blueonyx.it</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hi Matt,<br class=""><br class=""><blockquote type="cite" class="">I recently heard about an update to OpenSSL (1.0.1q and 1.0.2e,<br class="">for those versions, respectively). Looking at the RPM changelog<br class="">on my machine, however, doesn’t appear to show that there’s been<br class="">an update to 5107R. Any news?<br class=""></blockquote><br class="">RedHat (and CentOS and SL for that matter) lock the version numbers for<br class="">libraries once the OS is released. So if something got released with<br class="">OpenSSL-1.0.1 (like EL6 did), then it usually stays with that. Often<br class="">until the EOL of that OS. Sometimes OpenSSL gets replaced with a newer<br class="">version during a minor release, though. But that then is never trivial<br class="">as almost anything is compiled against OpenSSL and might then break.<br class=""><br class="">Therefore RedHat usually backports fixes to the version(s) they ship and<br class="">just bumps the release number to indicate this. The current OpenSSL on<br class="">EL6 is openssl-1.0.1e-42.<br class=""><br class="">However, there is another side-effect: As RedHat backports fixes from<br class="">newer OpenSSL releases to their own (older) versions of OpenSSL that are<br class="">in their shipped OS's: Sometimes the RedHat versions aren't affected by<br class="">the bugs in first place.<br class=""><br class="">So let us look at the vulnerability announcement to find out the CVE<br class="">numbers:<br class=""><br class=""><a href="https://openssl.org/news/secadv/20151203.txt" class="">https://openssl.org/news/secadv/20151203.txt</a><br class=""><br class="">BN_mod_exp may produce incorrect results on x86_64 (CVE-2015-3193)<br class="">Certificate verify crash with missing PSS parameter (CVE-2015-3194)<br class="">X509_ATTRIBUTE memory leak (CVE-2015-3195)<br class="">Race condition handling PSK identify hint (CVE-2015-3196)<br class="">Anon DH ServerKeyExchange with 0 p parameter (CVE-2015-1794)<br class=""><br class="">Now let us look the CVE's up at RHN:<br class=""><br class="">https://access.redhat.com/security/cve/cve-2015-3193<br class="">https://access.redhat.com/security/cve/cve-2015-3194<br class="">https://access.redhat.com/security/cve/cve-2015-3195<br class="">https://access.redhat.com/security/cve/cve-2015-3196<br class="">https://access.redhat.com/security/cve/cve-2015-1794<br class=""><br class="">Results:<br class=""><br class="">CVE EL5 EL6 EL7<br class="">---------------------------------------------<br class="">3193: OK OK OK<br class="">3194: OK NOT OK NOT OK<br class="">3195: NOT OK NOT OK NOT OK<br class="">3196: OK NOT OK OK<br class="">1794: OK OK OK<br class=""><br class="">So this is kinda hit and miss and the OpenSSL on EL5, EL6 and EL7. None<br class="">is affected by all of it, but all are affected by some of these issues<br class="">in one form or another.<br class=""><br class="">I suspect updated RPMs will soon be available from upstream.<br class=""><br class="">-- <br class="">With best regards<br class=""><br class="">Michael Stauber<br class="">_______________________________________________<br class="">Blueonyx mailing list<br class="">Blueonyx@mail.blueonyx.it<br class="">http://mail.blueonyx.it/mailman/listinfo/blueonyx<br class=""></div></div></blockquote></div><br class=""></div></body></html>