Information Exposure Affecting openssl Open this link in a new tab package, versions >=1.0.1, <1.0.200 >=1.0.204.1, <1.0.206

OpenSSL is a SSL/TLS and Crypto toolkit. Deprecated in Mac OS and gone in iOS, this spec gives your project non-deprecated OpenSSL support.

Affected versions of this package are vulnerable to Information Exposure. OpenSSL uses unsafe number generation. The library generates unsafe prime numbers, allowing a malicious user that can force a peer to perform multiple handshakes to conduct a man-in-the-middle attack.

• Cert Vulnerability Note
• Fedora Security Announcement
• Gentoo Security Advisory
• HPE Support Center Security Bulletin
• HPE Support Center Security Bulletin
• http://intothesymmetry.blogspot.com/2016/01/openssl-key-recovery-attack-on-dh-small.html
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
• https://git.openssl.org/?p=openssl.git;a=commit;h=878e2c5b13010329c203f309ed0c8f2113f85648
• https://git.openssl.org/?p=openssl.git;a=commit;h=c5b831f21d0d29d1e517d139d9d101763f60c9a2
• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03724en_us
• OpenSSL Security Advisory
• OpenSuse Security Announcement
• Oracle Security Advisory
• Oracle Security Advisory
• Security Focus
• Security Focus
• Security Tracker
• Ubuntu Security Advisory