1

My security admin is worried that my OpenSSL version does not contain a patch for DROWN (cve-2016-0800).

I ran a yum update and have installed the latest Centos 7 OpenSSL: openssl-1.0.1e-51.el7_2.5.x86_64

When I check the changelog using rpm -q --changelog openssl-libs | grep 2016 I have recent CVE fixes but not one for 2016-0800. Is the official Centos 7 OpenSSL really still vulnerable? If not how can I prove my install is valid?

Is it possible that the RPM I got is mistagged? If so how do I get its checksum and where can I verify it against an rpm release?

I realize there are tests specifically for DROWN but this is one example among many other missing CVEs and I don't to be on the hook to individually test each one.

Improve this question
3
  • 1
    RedHat back port security fixes. OpenSSL fixed DROWN in the 1.0.1 version in 1.0.1m. RedHat take the fix from 1.0.1m and apply it to 1.0.1e. So I think you do have the fix, and your security admin is incorrectly saying 1.0.1e is vulnerable. Disclaimer: I'm not 100% sure this is correct on your system, so please check a little more :)
    – paj28
    Commented Jul 27, 2016 at 21:50
  • Thanks, I'm 99% sure I do have the fix but due to politics I need a way to prove that the fix is there (and an easy way to prove that the other missing CVEs are also there).
    – Alex Ethier
    Commented Jul 27, 2016 at 22:17
  • You can use the RedHat security advisories to show that - they include both the RedHat package versions and the fixed CVEs.
    – paj28
    Commented Jul 28, 2016 at 10:26

2 Answers 2

Reset to default
1

According to the Red Hat security advisory for that CVE, RHEL 7 is not affected. If you follow the article in the external references to another security advisory, you'll see it says:

Note: This issue was addressed by disabling the SSLv2 protocol by default when using the 'SSLv23' connection methods, and removing support for weak SSLv2 cipher suites. For more information, refer to the knowledge base article linked to in the References section.

Improve this answer
0

I realized what I was really looking for was: https://github.com/OpenSCAP/openscap

It should scan and verify that my system's RPMs are up to date with any CVEs.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .