My security admin is worried that my OpenSSL version does not contain a patch for DROWN (
I ran a yum update and have installed the latest Centos 7 OpenSSL:
When I check the changelog using
rpm -q --changelog openssl-libs | grep 2016 I have recent CVE fixes but not one for 2016-0800. Is the official Centos 7 OpenSSL really still vulnerable? If not how can I prove my install is valid?
Is it possible that the RPM I got is mistagged? If so how do I get its checksum and where can I verify it against an rpm release?
I realize there are tests specifically for DROWN but this is one example among many other missing CVEs and I don't to be on the hook to individually test each one.