RHSA-2016:1940HighCVSS 7.5

Red Hat Security Advisory: openssl security update

Published
September 27, 2016
Last Modified
October 23, 2026

🔗 CVE IDs covered (10)

CVE-2016-6302 →CVE-2016-6304 →CVE-2016-2179 →CVE-2016-2180 →CVE-2016-2182 →CVE-2016-2183 →CVE-2016-6306 →CVE-2016-2177 →CVE-2016-2178 →CVE-2016-2181 →

📋 Description

CVE-2016-2177 — openssl: Possible integer overflow vulnerabilities in codebase CVE-2016-2178 — openssl: Non-constant time codepath followed for certain operations in DSA implementation CVE-2016-2179 — openssl: DTLS memory exhaustion DoS when messages are not removed from fragment buffer CVE-2016-2180 — OpenSSL: OOB read in TS_OBJ_print_bio() CVE-2016-2181 — openssl: DTLS replay protection bypass allows DoS against DTLS connection CVE-2016-2182 — openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec() CVE-2016-2183 — SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32) CVE-2016-6302 — openssl: Insufficient TLS session ticket HMAC length checks CVE-2016-6304 — openssl: OCSP Status Request extension unbounded memory growth CVE-2016-6306 — openssl: certificate message OOB reads

🎯 Affected products167

  • Red Hat Enterprise Linux Client (v. 7)
  • Red Hat Enterprise Linux Client Optional (v. 7)
  • Red Hat Enterprise Linux ComputeNode (v. 7)
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7)
  • Red Hat Enterprise Linux Desktop (v. 6)
  • Red Hat Enterprise Linux Desktop Optional (v. 6)
  • Red Hat Enterprise Linux HPC Node (v. 6)
  • Red Hat Enterprise Linux HPC Node Optional (v. 6)
  • Red Hat Enterprise Linux Server (v. 6)
  • Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Enterprise Linux Server Optional (v. 6)
  • Red Hat Enterprise Linux Server Optional (v. 7)
  • Red Hat Enterprise Linux Workstation (v. 6)
  • Red Hat Enterprise Linux Workstation (v. 7)
  • Red Hat Enterprise Linux Workstation Optional (v. 6)
  • Red Hat Enterprise Linux Workstation Optional (v. 7)
  • openssl-0:1.0.1e-48.el6_8.3.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • openssl-0:1.0.1e-48.el6_8.3.i686 as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • openssl-0:1.0.1e-48.el6_8.3.i686 as a component of Red Hat Enterprise Linux Server (v. 6)
  • openssl-0:1.0.1e-48.el6_8.3.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • openssl-0:1.0.1e-48.el6_8.3.ppc as a component of Red Hat Enterprise Linux Server (v. 6)
  • openssl-0:1.0.1e-48.el6_8.3.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)
  • openssl-0:1.0.1e-48.el6_8.3.s390 as a component of Red Hat Enterprise Linux Server (v. 6)
  • openssl-0:1.0.1e-48.el6_8.3.s390x as a component of Red Hat Enterprise Linux Server (v. 6)
  • openssl-0:1.0.1e-48.el6_8.3.src as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • openssl-0:1.0.1e-48.el6_8.3.src as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • openssl-0:1.0.1e-48.el6_8.3.src as a component of Red Hat Enterprise Linux Server (v. 6)
  • openssl-0:1.0.1e-48.el6_8.3.src as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • openssl-0:1.0.1e-48.el6_8.3.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • openssl-0:1.0.1e-48.el6_8.3.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • +137 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. Workaround: 1.SSL/TLS configurations should prefer AES over DES. Versions of OpenSSL shipped with Red Hat Enterprise Linux 6 and 7 already do so. In the version of OpenSSL shipped with Red Hat Enterprise Linux 5, 3DES is listed below the AES-256 cipher and above the AES-128 cipher, therefore AES-256 based ciphersuite should not be disabled on the server. 2. Servers using OpenSSL, should not disable AES-128 and AES-256 ciphersuites. Versions of Apache shipped with Red Hat Enterprise Linux use the default cipher string, in which AES is preferred over DES/3DES based ciphersuites. For JBoss Middleware, and Java mitigations, please review this knowledge base article: https://access.redhat.com/articles/2598471 This can be mitigated on OpenShift Container Platform (OCP) by disabling the vulnerable TLS cipher suite in the applicable component. TLS configuration options for OCP are described here: https://access.redhat.com/articles/5348961

🔗 References (14)