OpenSSL CVE-2016-2176, CVE-2016-2178

[paulmancan]

Vuln scanning is detecting these. I do not see back ported patches noted.

RHN reports on these two seem ambiguous.

Are these legitimate vulnerabilities?


Thanks!

[avij]

CVE-2016-2176: "not affected" https://access.redhat.com/security/cve/cve-2016-2176

CVE-2016-2178: "fix deferred" https://access.redhat.com/security/cve/cve-2016-2178 and https://bugzilla.redhat.com/show_bug.cg ... -2016-2178 -- I interpret this as "a fix will be included in the next convenient release of openssl, but there's no rush".

[paulmancan]

Thanks that was what I saw too but felt that this was ambiguous " in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h " Centos 7 be on 1.0.1e so.... just the way I read this errata I guess?

[avij]

For -2176: "OpenSSL packages distributed by Red Hat do not enable EBCDIC support and are therefore unaffected by this issue.", so even though the version matches, the vulnerable functionality is not enabled in the packages distributed by Red Hat / CentOS.

For -2178: Yes, the RH / CentOS version is vulnerable, but its low severity does not warrant an immediate update.

[paulmancan]

Awesome thanks for your quick reply!