blob: 070e070a639593ae7ecc8d41fc3c6250ab0de70d [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200510-11">
<title>OpenSSL: SSL 2.0 protocol rollback</title>
When using a specific option, OpenSSL can be forced to fallback to the less
secure SSL 2.0 protocol.
<product type="ebuild">OpenSSL</product>
<announced>October 12, 2005</announced>
<revised>November 07, 2005: 02</revised>
<package name="dev-libs/openssl" auto="yes" arch="*">
<unaffected range="ge">0.9.7h</unaffected>
<unaffected range="rge">0.9.7g-r1</unaffected>
<unaffected range="rge">0.9.7e-r2</unaffected>
<vulnerable range="lt">0.9.7h</vulnerable>
OpenSSL is a toolkit implementing the Secure Sockets Layer, Transport
Layer Security protocols and a general-purpose cryptography library.
Applications setting the SSL_OP_MSIE_SSLV2_RSA_PADDING option (or the
SSL_OP_ALL option, that implies it) can be forced by a third-party to
fallback to the less secure SSL 2.0 protocol, even if both parties
support the more secure SSL 3.0 or TLS 1.0 protocols.
<impact type="low">
A man-in-the-middle attacker can weaken the encryption used to
communicate between two parties, potentially revealing sensitive
If possible, disable the use of SSL 2.0 in all OpenSSL-enabled
All OpenSSL users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose dev-libs/openssl</code>
<uri link="">CAN-2005-2969</uri>
<uri link=" ">OpenSSL security advisory</uri>
<metadata tag="requester" timestamp="Tue, 11 Oct 2005 07:50:27 +0000">
<metadata tag="submitter" timestamp="Tue, 11 Oct 2005 08:03:33 +0000">
<metadata tag="bugReady" timestamp="Wed, 12 Oct 2005 07:47:42 +0000">