Red Hat Security Advisory: python security update
🔗 CVE IDs covered (1)
📋 Description
CVE-2016-2183 — SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)
🎯 Affected products119
- Red Hat Enterprise Linux Client (v. 7)
- Red Hat Enterprise Linux Client Optional (v. 7)
- Red Hat Enterprise Linux ComputeNode (v. 7)
- Red Hat Enterprise Linux ComputeNode Optional (v. 7)
- Red Hat Enterprise Linux Server (v. 7)
- Red Hat Enterprise Linux Server Optional (v. 7)
- Red Hat Enterprise Linux Workstation (v. 7)
- Red Hat Enterprise Linux Workstation Optional (v. 7)
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)
- python-0:2.7.5-69.el7_5.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)
- python-0:2.7.5-69.el7_5.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)
- python-0:2.7.5-69.el7_5.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)
- python-0:2.7.5-69.el7_5.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)
- python-0:2.7.5-69.el7_5.s390x as a component of Red Hat Enterprise Linux Server (v. 7)
- python-0:2.7.5-69.el7_5.s390x as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)
- python-0:2.7.5-69.el7_5.src as a component of Red Hat Enterprise Linux Client (v. 7)
- python-0:2.7.5-69.el7_5.src as a component of Red Hat Enterprise Linux ComputeNode (v. 7)
- python-0:2.7.5-69.el7_5.src as a component of Red Hat Enterprise Linux Server (v. 7)
- python-0:2.7.5-69.el7_5.src as a component of Red Hat Enterprise Linux Workstation (v. 7)
- python-0:2.7.5-69.el7_5.src as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)
- python-0:2.7.5-69.el7_5.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)
- python-0:2.7.5-69.el7_5.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)
- python-0:2.7.5-69.el7_5.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)
- python-0:2.7.5-69.el7_5.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)
- python-debug-0:2.7.5-69.el7_5.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)
- python-debug-0:2.7.5-69.el7_5.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)
- python-debug-0:2.7.5-69.el7_5.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)
- python-debug-0:2.7.5-69.el7_5.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)
- python-debug-0:2.7.5-69.el7_5.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)
- +89 more not shown
✅ Remediation
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: 1.SSL/TLS configurations should prefer AES over DES. Versions of OpenSSL shipped with Red Hat Enterprise Linux 6 and 7 already do so. In the version of OpenSSL shipped with Red Hat Enterprise Linux 5, 3DES is listed below the AES-256 cipher and above the AES-128 cipher, therefore AES-256 based ciphersuite should not be disabled on the server. 2. Servers using OpenSSL, should not disable AES-128 and AES-256 ciphersuites. Versions of Apache shipped with Red Hat Enterprise Linux use the default cipher string, in which AES is preferred over DES/3DES based ciphersuites. For JBoss Middleware, and Java mitigations, please review this knowledge base article: https://access.redhat.com/articles/2598471 This can be mitigated on OpenShift Container Platform (OCP) by disabling the vulnerable TLS cipher suite in the applicable component. TLS configuration options for OCP are described here: https://access.redhat.com/articles/5348961