USN-2863-1: OpenSSL vulnerability
07 January 2016
OpenSSL could be made to expose sensitive information over the network.
- openssl - Secure Socket Layer (SSL) cryptographic library and tools
Karthikeyan Bhargavan and Gaetan Leurent discovered that OpenSSL
incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote
attacker were able to perform a man-in-the-middle attack, this flaw could
be exploited to view sensitive information.
- USN-2864-1: nss, libnss3
- USN-2865-1: libgnutls-openssl27, gnutls26, libgnutls-deb0-28, libgnutls26, libgnutlsxx28, gnutls28, libgnutlsxx27
- USN-2866-1: firefox
- USN-2884-1: openjdk-7, openjdk-7-jre-headless, openjdk-7-jre-zero, icedtea-7-jre-jamvm, openjdk-7-jre, openjdk-7-jre-lib
- USN-2904-1: thunderbird