2015-12-03 - OpenSSL Vulnerabilities
====================================

OpenSSL announced security fixes on 12/03/15 in the following bulletin: http://openssl.org/news/secadv/20151203.txt

Advisory CVEs
-------------

* CVE-2015-3193 - **BN_mod_exp may produce incorrect results on x86_64** (Severity:Moderate)

    OpenSSL 1.0.2 users should upgrade to 1.0.2e

* CVE-2015-3194 - **Certificate verify crash with missing PSS parameter** (Severity:Moderate)

    OpenSSL 1.0.2 users should upgrade to 1.0.2e
    OpenSSL 1.0.1 users should upgrade to 1.0.1q

* CVE-2015-3195 - **X509_ATTRIBUTE memory leak** (Severity:Moderate)

    OpenSSL 1.0.2 users should upgrade to 1.0.2e
    OpenSSL 1.0.1 users should upgrade to 1.0.1q
    OpenSSL 1.0.0 users should upgrade to 1.0.0t
    OpenSSL 0.9.8 users should upgrade to 0.9.8zh

* CVE-2015-3196 - **Race condition handling PSK identify hint** (Severity:Low)

    OpenSSL 1.0.2 users should upgrade to 1.0.2d
    OpenSSL 1.0.1 users should upgrade to 1.0.1p
    OpenSSL 1.0.0 users should upgrade to 1.0.0t

* CVE-2015-1794 - **Anon DH ServerKeyExchange with 0 p parameter** (Severity:Low)

    OpenSSL 1.0.2 users should upgrade to 1.0.2e


Action
------

xCAT uses OpenSSL for client-server communication but **does not** ship it.  

It is recommended to keep your OpenSSL levels up-to-date with the indicated versions in the security bulletins to prevent any potential security threats.