OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the CCS Injection vulnerability.
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openssl | Openssl | * | 0.9.8za (excluding) |
| Openssl | Openssl | 1.0.0 (including) | 1.0.0m (excluding) |
| Openssl | Openssl | 1.0.1 (including) | 1.0.1h (excluding) |
| Red Hat Enterprise Linux 4 Extended Lifecycle Support | RedHat | openssl-0:0.9.7a-43.22.el4 | * |
| Red Hat Enterprise Linux 5 | RedHat | openssl-0:0.9.8e-27.el5_10.3 | * |
| Red Hat Enterprise Linux 5 | RedHat | openssl097a-0:0.9.7a-12.el5_10.1 | * |
| Red Hat Enterprise Linux 5.6 Long Life | RedHat | openssl-0:0.9.8e-12.el5_6.12 | * |
| Red Hat Enterprise Linux 5.9 Extended Update Support | RedHat | openssl-0:0.9.8e-26.el5_9.4 | * |
| Red Hat Enterprise Linux 6 | RedHat | openssl-0:1.0.1e-16.el6_5.14 | * |
| Red Hat Enterprise Linux 6 | RedHat | openssl098e-0:0.9.8e-18.el6_5.2 | * |
| Red Hat Enterprise Linux 6.2 Advanced Update Support | RedHat | openssl-0:1.0.0-20.el6_2.7 | * |
| Red Hat Enterprise Linux 6.3 EUS - Server and Compute Node Only | RedHat | openssl-0:1.0.0-25.el6_3.3 | * |
| Red Hat Enterprise Linux 6.4 Extended Update Support | RedHat | openssl-0:1.0.0-27.el6_4.4 | * |
| Red Hat Enterprise Linux 7 | RedHat | openssl-1:1.0.1e-34.el7_0.3 | * |
| Red Hat Enterprise Linux 7 | RedHat | openssl098e-0:0.9.8e-29.el7_0.2 | * |
| Red Hat JBoss Enterprise Application Platform 5.2 | RedHat | * | |
| Red Hat JBoss Enterprise Application Platform 6.2 | RedHat | * | |
| Red Hat JBoss Web Platform 5.2 | RedHat | * | |
| Red Hat JBoss Web Server 2.0 | RedHat | openssl | * |
| Red Hat Storage 2.1 | RedHat | openssl-0:1.0.1e-16.el6_5.14 | * |
| RHEV 3.X Hypervisor and Agents for RHEL-6 | RedHat | rhev-hypervisor6-0:6.5-20140603.1.el6ev | * |
| Openssl | Ubuntu | devel | * |
| Openssl | Ubuntu | lucid | * |
| Openssl | Ubuntu | precise | * |
| Openssl | Ubuntu | saucy | * |
| Openssl | Ubuntu | trusty | * |
| Openssl | Ubuntu | upstream | * |
| Openssl098 | Ubuntu | devel | * |
| Openssl098 | Ubuntu | precise | * |
| Openssl098 | Ubuntu | saucy | * |
| Openssl098 | Ubuntu | trusty | * |
| Openssl098 | Ubuntu | upstream | * |