USN-2863-1: OpenSSL vulnerability
07 January 2016
OpenSSL could be made to expose sensitive information over the network.
- openssl - Secure Socket Layer (SSL) cryptographic library and tools
Karthikeyan Bhargavan and Gaetan Leurent discovered that OpenSSL
incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote
attacker were able to perform a man-in-the-middle attack, this flaw could
be exploited to view sensitive information.