rhsa-2002_184
Vulnerability from csaf_redhat
Published
2002-08-19 14:40
Modified
2024-09-12 21:47
Summary
Red Hat Security Advisory: openssl security update for Stronghold
Notes
Topic
A new Stronghold 3 release is available which contains an updated fix for
the OpenSSL ASN1 vulnerability.
Details
OpenSSL is a commercial-grade, full-featured, open source toolkit which
implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer
Security (TLS v1) protocols, as well as a full-strength general purpose
cryptography library.
The OpenSSL group found an issue in the patch that was released to fix the
previous vulnerability in the ASN.1 routines (RHSA-2002-164,
CAN-2002-0659). The previous patch did not completely eliminate the
initial vulnerability and could lead to Denial of Service (DoS) attacks
against a server. It has not been verified if this issue could lead to
further consequences, such as remote code execution.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new Stronghold 3 release is available which contains an updated fix for\nthe OpenSSL ASN1 vulnerability.",
"title": "Topic"
},
{
"category": "general",
"text": "OpenSSL is a commercial-grade, full-featured, open source toolkit which\nimplements the Secure Sockets Layer (SSL v2/v3) and Transport Layer\nSecurity (TLS v1) protocols, as well as a full-strength general purpose\ncryptography library. \n\nThe OpenSSL group found an issue in the patch that was released to fix the\nprevious vulnerability in the ASN.1 routines (RHSA-2002-164,\nCAN-2002-0659). The previous patch did not completely eliminate the\ninitial vulnerability and could lead to Denial of Service (DoS) attacks\nagainst a server. It has not been verified if this issue could lead to\nfurther consequences, such as remote code execution.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2002:184",
"url": "https://access.redhat.com/errata/RHSA-2002:184"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/data/csaf/v2/advisories/2002/rhsa-2002_184.json"
}
],
"title": "Red Hat Security Advisory: openssl security update for Stronghold",
"tracking": {
"current_release_date": "2024-09-12T21:47:30+00:00",
"generator": {
"date": "2024-09-12T21:47:30+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "3.33.3"
}
},
"id": "RHSA-2002:184",
"initial_release_date": "2002-08-19T14:40:00+00:00",
"revision_history": [
{
"date": "2002-08-19T14:40:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2002-08-19T00:00:00+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-09-12T21:47:30+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Stronghold 3",
"product": {
"name": "Red Hat Stronghold 3",
"product_id": "Red Hat Stronghold 3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:stronghold:3"
}
}
}
],
"category": "product_family",
"name": "Stronghold Cross Platform"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2002-0659",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616792"
}
],
"notes": [
{
"category": "description",
"text": "The ASN1 library in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allows remote attackers to cause a denial of service via invalid encodings.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Stronghold 3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2002-0659"
},
{
"category": "external",
"summary": "RHBZ#1616792",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616792"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2002-0659",
"url": "https://www.cve.org/CVERecord?id=CVE-2002-0659"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0659",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0659"
}
],
"release_date": "2002-07-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "We have backported the fix for the version of OpenSSL included in\nStronghold 3. Stronghold 3 build code 3019 is now available which\nincludes this fix, and can be downloaded from \nhttp://stronghold.redhat.com/sh3/\n\nFor information on how to upgrade between releases of Stronghold 3, see \nhttp://stronghold.redhat.com/support/upgrade-sh3.xml",
"product_ids": [
"Red Hat Stronghold 3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2002:184"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "security flaw"
}
]
}
Loading...