Описание
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.
A flaw was found in the way SSL 3.0 handled padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. This flaw allows a man-in-the-middle (MITM) attacker to decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections.
Отчет
This issue affects the version of openssl as shipped with Red Hat Enterprise Linux 5, 6 and 7, Red Hat JBoss Enterprise Application Platform 5 and 6, and Red Hat JBoss Web Server 1 and 2, Red Hat Enterprise Virtualization Hypervisor 6.5, and Red Hat Storage 2.1. This issue affects the version of nss as shipped with Red Hat Enterprise Linux 5, 6 and 7. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/articles/1232123
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Enterprise 1 | jenkins | Will not fix | ||
| OpenStack Foreman | puppet | Will not fix | ||
| Red Hat Enterprise Linux 5 | gnutls | Under investigation | ||
| Red Hat Enterprise Linux 5 | nss | Affected | ||
| Red Hat Enterprise Linux 5 | openssl097a | Affected | ||
| Red Hat Enterprise Linux 6 | gnutls | Under investigation | ||
| Red Hat Enterprise Linux 6 | nss | Affected | ||
| Red Hat Enterprise Linux 7 | gnutls | Under investigation | ||
| Red Hat Enterprise Linux 7 | openssl098e | Affected | ||
| Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) | puppet | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
5 Medium
CVSS2
Связанные уязвимости
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other prod ...
EPSS
5 Medium
CVSS2