My security admin is worried that my OpenSSL version does not contain a patch for DROWN (cve-2016-0800).

I ran a yum update and have installed the latest Centos 7 OpenSSL: openssl-1.0.1e-51.el7_2.5.x86_64

When I check the changelog using rpm -q --changelog openssl-libs | grep 2016 I have recent CVE fixes but not one for 2016-0800. Is the official Centos 7 OpenSSL really still vulnerable? If not how can I prove my install is valid?

Is it possible that the RPM I got is mistagged? If so how do I get its checksum and where can I verify it against an rpm release?

I realize there are tests specifically for DROWN but this is one example among many other missing CVEs and I don't to be on the hook to individually test each one.

  • 1
    RedHat back port security fixes. OpenSSL fixed DROWN in the 1.0.1 version in 1.0.1m. RedHat take the fix from 1.0.1m and apply it to 1.0.1e. So I think you do have the fix, and your security admin is incorrectly saying 1.0.1e is vulnerable. Disclaimer: I'm not 100% sure this is correct on your system, so please check a little more :) – paj28 Jul 27 '16 at 21:50
  • Thanks, I'm 99% sure I do have the fix but due to politics I need a way to prove that the fix is there (and an easy way to prove that the other missing CVEs are also there). – Alex Ethier Jul 27 '16 at 22:17
  • You can use the RedHat security advisories to show that - they include both the RedHat package versions and the fixed CVEs. – paj28 Jul 28 '16 at 10:26

According to the Red Hat security advisory for that CVE, RHEL 7 is not affected. If you follow the article in the external references to another security advisory, you'll see it says:

Note: This issue was addressed by disabling the SSLv2 protocol by default when using the 'SSLv23' connection methods, and removing support for weak SSLv2 cipher suites. For more information, refer to the knowledge base article linked to in the References section.


I realized what I was really looking for was: https://github.com/OpenSCAP/openscap

It should scan and verify that my system's RPMs are up to date with any CVEs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.