ID

VAR-201505-0233

CVE

CVE-2015-4000

TITLE

OpenSSL CVE-2015-1793 Certificate Verification Security Bypass Vulnerability

DESCRIPTION

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue. OpenSSL is prone to a security-bypass vulnerability because the application fails to properly verify SSL, TLS, and DTLS certificates. Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks and bypass certain security restrictions. This may aid in further attacks. OpenSSL versions 1.0.2c, 1.0.2b, 1.0.1n, and 1.0.1o are vulnerable. SSL/TLS is prone to security-bypass vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04772190 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04772190 Version: 2 HPSBGN03402 rev.2 - HP Performance Manager, Remote Disclosure of Information NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2015-08-26 Last Updated: 2015-08-26 Potential Security Impact: Remote disclosure of information Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY Potential security vulnerabilities have been identified in HP Performance Manager. - The TLS vulnerability using US export-grade 512-bit keys in Diffie-Hellman key exchange known as "Logjam" could be exploited remotely to allow unauthorized modification. - The RC4 stream cipher vulnerability in SSL/TLS known as "Bar Mitzvah" could be exploited remotely to allow disclosure of information. References: CVE-2015-4000 - "Logjam" CVE-2015-2808 - "Bar Mitzvah" SSRT102204, SSRT102208 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP Performance Manager v9.0x and v9.20. BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2015-2808 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 CVE-2015-4000 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has made the following mitigation information and software updates available to resolve the vulnerabilities for the impacted versions of HP Performance Manager. Please consult HP Software Support Online (SSO): CVE-2015-4000 - "Logjam" https://softwaresupport.hp.com/group/softwaresupport/search-result/-/fa cetsearch/document/KM01766982 CVE-2015-2808 - "Bar Mitzvah" https://softwaresupport.hp.com/group/softwaresupport/search-result/-/fa cetsearch/document/KM01766997?lang=en&cc=us&hpappid=113963_OSP_PRO_HPE HISTORY Version:1 (rev.1) - 26 August 2015 Initial release Version:2 (rev.2) - 26 August 2015 Added missing CVSS entry for CVE-2015-4000 Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2015 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. CVE-2015-4000 David Adrian et al. reported that it may be feasible to attack Diffie-Hellman-based cipher suites in certain circumstances, compromising the confidentiality and integrity of data encrypted with Transport Layer Security (TLS). CVE-2015-7181 CVE-2015-7182 CVE-2016-1950 Tyson Smith, David Keeler, and Francis Gabriel discovered heap-based buffer overflows in the ASN.1 DER parser, potentially leading to arbitrary code execution. CVE-2015-7575 Karthikeyan Bhargavan discovered that TLS client implementation accepted MD5-based signatures for TLS 1.2 connections with forward secrecy, weakening the intended security strength of TLS connections. CVE-2016-1938 Hanno Boeck discovered that NSS miscomputed the result of integer division for certain inputs. This could weaken the cryptographic protections provided by NSS. However, NSS implements RSA-CRT leak hardening, so RSA private keys are not directly disclosed by this issue. CVE-2016-1978 Eric Rescorla discovered a user-after-free vulnerability in the implementation of ECDH-based TLS handshakes, with unknown consequences. CVE-2016-1979 Tim Taubert discovered a use-after-free vulnerability in ASN.1 DER processing, with application-specific impact. CVE-2016-2834 Tyson Smith and Jed Davis discovered unspecified memory-safety bugs in NSS. In addition, the NSS library did not ignore environment variables in processes which underwent a SUID/SGID/AT_SECURE transition at process start. In certain system configurations, this allowed local users to escalate their privileges. For the stable distribution (jessie), these problems have been fixed in version 2:3.26-1+debu8u1. For the unstable distribution (sid), these problems have been fixed in version 2:3.23-1. + VCX v9.8.17 for the following Products/SKUs: - J9672A HP VCX V7205 Platform w/ DL360 G7 Srvr - J9668A HP VCX IPC V7005 Pltfrm w/ DL120 G6 Srvr - JC517A HP VCX V7205 Platform w/DL 360 G6 Server - JE355A HP VCX V6000 Branch Platform 9.0 - JC516A HP VCX V7005 Platform w/DL 120 G6 Server - JC518A HP VCX Connect 200 Primry 120 G6 Server - J9669A HP VCX IPC V7310 Pltfrm w/ DL360 G7 Srvr - JE341A HP VCX Connect 100 Secondary - JE252A HP VCX Connect Primary MIM Module - JE253A HP VCX Connect Secondary MIM Module - JE254A HP VCX Branch MIM Module - JE355A HP VCX V6000 Branch Platform 9.0 - JD028A HP MS30-40 RTR w/VCX + T1/FXO/FXS/Mod - JD023A HP MSR30-40 Router with VCX MIM Module - JD024A HP MSR30-16 RTR w/VCX Ent Br Com MIM - JD025A HP MSR30-16 RTR w/VCX + 4FXO/2FXS Mod - JD026A HP MSR30-16 RTR w/VCX + 8FXO/4FXS Mod - JD027A HP MSR30-16 RTR w/VCX + 8BRI/4FXS Mod - JD029A HP MSR30-16 RTR w/VCX + E1/4BRI/4FXS - JE340A HP VCX Connect 100 Pri Server 9.0 - JE342A HP VCX Connect 100 Sec Server 9.0 HISTORY Version:1 (rev.1) - 16 December 2015 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. ============================================================================ Ubuntu Security Notice USN-2656-2 July 15, 2015 firefox vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 LTS Summary: Firefox could be made to crash or run programs as your login if it opened a malicious website. Software Description: - firefox: Mozilla Open Source web browser Details: USN-2656-1 fixed vulnerabilities in Firefox for Ubuntu 14.04 LTS and later releases. This update provides the corresponding update for Ubuntu 12.04 LTS. Original advisory details: Karthikeyan Bhargavan discovered that NSS incorrectly handled state transitions for the TLS state machine. (CVE-2015-2721) Looben Yan discovered 2 use-after-free issues when using XMLHttpRequest in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-2722, CVE-2015-2733) Bob Clary, Christian Holler, Bobby Holley, Andrew McCreight, Terrence Cole, Steve Fink, Mats Palmgren, Wes Kocher, Andreas Pehrson, Tooru Fujisawa, Andrew Sutherland, and Gary Kwong discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-2724, CVE-2015-2725, CVE-2015-2726) Armin Razmdjou discovered that opening hyperlinks with specific mouse and key combinations could allow a Chrome privileged URL to be opened without context restrictions being preserved. (CVE-2015-2727) Paul Bandha discovered a type confusion bug in the Indexed DB Manager. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the priviliges of the user invoking Firefox. (CVE-2015-2728) Holger Fuhrmannek discovered an out-of-bounds read in Web Audio. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2015-2729) Watson Ladd discovered that NSS incorrectly handled Elliptical Curve Cryptography (ECC) multiplication. A remote attacker could possibly use this issue to spoof ECDSA signatures. (CVE-2015-2730) A use-after-free was discovered when a Content Policy modifies the DOM to remove a DOM object. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the priviliges of the user invoking Firefox. (CVE-2015-2731) Ronald Crane discovered multiple security vulnerabilities. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-2734, CVE-2015-2735, CVE-2015-2736, CVE-2015-2737, CVE-2015-2738, CVE-2015-2739, CVE-2015-2740) David Keeler discovered that key pinning checks can be skipped when an overridable certificate error occurs. This allows a user to manually override an error for a fake certificate, but cannot be exploited on its own. (CVE-2015-2741) Jonas Jenwald discovered that some internal workers were incorrectly executed with a high privilege. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this in combination with another security vulnerability, to execute arbitrary code in a privileged scope. (CVE-2015-2743) Matthew Green discovered a DHE key processing issue in NSS where a MITM could force a server to downgrade TLS connections to 512-bit export-grade cryptography. An attacker could potentially exploit this to impersonate the server. (CVE-2015-4000) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.04 LTS: firefox 39.0+build5-0ubuntu0.12.04.2 After a standard system update you need to restart Firefox to make all the necessary changes. HP Operations Agent Virtual Appliance v11.11, v11.12, v11.13, v11.14. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: java-1.6.0-openjdk security update Advisory ID: RHSA-2015:1526-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1526.html Issue date: 2015-07-30 CVE Names: CVE-2015-2590 CVE-2015-2601 CVE-2015-2621 CVE-2015-2625 CVE-2015-2628 CVE-2015-2632 CVE-2015-2808 CVE-2015-4000 CVE-2015-4731 CVE-2015-4732 CVE-2015-4733 CVE-2015-4748 CVE-2015-4749 CVE-2015-4760 ===================================================================== 1. Summary: Updated java-1.6.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - i386, x86_64 Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2015-4760, CVE-2015-2628, CVE-2015-4731, CVE-2015-2590, CVE-2015-4732, CVE-2015-4733) A flaw was found in the way the Libraries component of OpenJDK verified Online Certificate Status Protocol (OCSP) responses. An OCSP response with no nextUpdate date specified was incorrectly handled as having unlimited validity, possibly causing a revoked X.509 certificate to be interpreted as valid. (CVE-2015-4748) It was discovered that the JCE component in OpenJDK failed to use constant time comparisons in multiple cases. An attacker could possibly use these flaws to disclose sensitive information by measuring the time used to perform operations using these non-constant time comparisons. (CVE-2015-2601) A flaw was found in the RC4 encryption algorithm. When using certain keys for RC4 encryption, an attacker could obtain portions of the plain text from the cipher text without the knowledge of the encryption key. (CVE-2015-2808) Note: With this update, OpenJDK now disables RC4 TLS/SSL cipher suites by default to address the CVE-2015-2808 issue. Refer to Red Hat Bugzilla bug 1207101, linked to in the References section, for additional details about this change. A flaw was found in the way the TLS protocol composed the Diffie-Hellman (DH) key exchange. A man-in-the-middle attacker could use this flaw to force the use of weak 512 bit export-grade keys during the key exchange, allowing them to decrypt all traffic. (CVE-2015-4000) Note: This update forces the TLS/SSL client implementation in OpenJDK to reject DH key sizes below 768 bits, which prevents sessions to be downgraded to export-grade keys. Refer to Red Hat Bugzilla bug 1223211, linked to in the References section, for additional details about this change. It was discovered that the JNDI component in OpenJDK did not handle DNS resolutions correctly. An attacker able to trigger such DNS errors could cause a Java application using JNDI to consume memory and CPU time, and possibly block further DNS resolution. (CVE-2015-4749) Multiple information leak flaws were found in the JMX and 2D components in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2015-2621, CVE-2015-2632) A flaw was found in the way the JSSE component in OpenJDK performed X.509 certificate identity verification when establishing a TLS/SSL connection to a host identified by an IP address. In certain cases, the certificate was accepted as valid if it was issued for a host name to which the IP address resolves rather than for the IP address. (CVE-2015-2625) All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1207101 - CVE-2015-2808 SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher 1223211 - CVE-2015-4000 LOGJAM: TLS connections which support export grade DHE key-exchange are vulnerable to MITM attacks 1241965 - CVE-2015-2625 OpenJDK: name for reverse DNS lookup used in certificate identity check (JSSE, 8067694) 1242019 - CVE-2015-2601 OpenJDK: non-constant time comparisons in crypto code (JCE, 8074865) 1242232 - CVE-2015-2628 OpenJDK: IIOPInputStream type confusion vulnerability (CORBA, 8076376) 1242234 - CVE-2015-4731 OpenJDK: improper permission checks in MBeanServerInvocationHandler (JMX, 8076397) 1242240 - CVE-2015-4732 OpenJDK: insufficient context checks during object deserialization (Libraries, 8076405) 1242275 - CVE-2015-4733 OpenJDK: RemoteObjectInvocationHandler allows calling finalize() (RMI, 8076409) 1242281 - CVE-2015-4748 OpenJDK: incorrect OCSP nextUpdate checking (Libraries, 8075374) 1242372 - CVE-2015-2621 OpenJDK: incorrect code permission checks in RMIConnectionImpl (JMX, 8075853) 1242379 - CVE-2015-4749 OpenJDK: DnsClient fails to release request information after error (JNDI, 8075378) 1242394 - CVE-2015-2632 ICU: integer overflow in LETableReference verifyLength() (OpenJDK 2D, 8077520) 1242447 - CVE-2015-4760 ICU: missing boundary checks in layout engine (OpenJDK 2D, 8071715) 1243139 - CVE-2015-2590 OpenJDK: deserialization issue in ObjectInputStream.readSerialData() (Libraries, 8076401) 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el5_11.src.rpm i386: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el5_11.i386.rpm java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el5_11.i386.rpm java-1.6.0-openjdk-demo-1.6.0.36-1.13.8.1.el5_11.i386.rpm java-1.6.0-openjdk-devel-1.6.0.36-1.13.8.1.el5_11.i386.rpm java-1.6.0-openjdk-javadoc-1.6.0.36-1.13.8.1.el5_11.i386.rpm java-1.6.0-openjdk-src-1.6.0.36-1.13.8.1.el5_11.i386.rpm x86_64: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el5_11.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el5_11.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.36-1.13.8.1.el5_11.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.36-1.13.8.1.el5_11.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.36-1.13.8.1.el5_11.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.36-1.13.8.1.el5_11.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el5_11.src.rpm i386: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el5_11.i386.rpm java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el5_11.i386.rpm java-1.6.0-openjdk-demo-1.6.0.36-1.13.8.1.el5_11.i386.rpm java-1.6.0-openjdk-devel-1.6.0.36-1.13.8.1.el5_11.i386.rpm java-1.6.0-openjdk-javadoc-1.6.0.36-1.13.8.1.el5_11.i386.rpm java-1.6.0-openjdk-src-1.6.0.36-1.13.8.1.el5_11.i386.rpm x86_64: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el5_11.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el5_11.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.36-1.13.8.1.el5_11.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.36-1.13.8.1.el5_11.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.36-1.13.8.1.el5_11.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.36-1.13.8.1.el5_11.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 6): Source: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el6_7.src.rpm i386: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el6_7.i686.rpm java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el6_7.i686.rpm x86_64: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): i386: java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el6_7.i686.rpm java-1.6.0-openjdk-demo-1.6.0.36-1.13.8.1.el6_7.i686.rpm java-1.6.0-openjdk-devel-1.6.0.36-1.13.8.1.el6_7.i686.rpm java-1.6.0-openjdk-javadoc-1.6.0.36-1.13.8.1.el6_7.i686.rpm java-1.6.0-openjdk-src-1.6.0.36-1.13.8.1.el6_7.i686.rpm x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el6_7.src.rpm x86_64: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el6_7.src.rpm i386: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el6_7.i686.rpm java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el6_7.i686.rpm java-1.6.0-openjdk-devel-1.6.0.36-1.13.8.1.el6_7.i686.rpm java-1.6.0-openjdk-javadoc-1.6.0.36-1.13.8.1.el6_7.i686.rpm x86_64: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): i386: java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el6_7.i686.rpm java-1.6.0-openjdk-demo-1.6.0.36-1.13.8.1.el6_7.i686.rpm java-1.6.0-openjdk-src-1.6.0.36-1.13.8.1.el6_7.i686.rpm x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el6_7.src.rpm i386: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el6_7.i686.rpm java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el6_7.i686.rpm java-1.6.0-openjdk-devel-1.6.0.36-1.13.8.1.el6_7.i686.rpm java-1.6.0-openjdk-javadoc-1.6.0.36-1.13.8.1.el6_7.i686.rpm x86_64: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): i386: java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el6_7.i686.rpm java-1.6.0-openjdk-demo-1.6.0.36-1.13.8.1.el6_7.i686.rpm java-1.6.0-openjdk-src-1.6.0.36-1.13.8.1.el6_7.i686.rpm x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.36-1.13.8.1.el6_7.x86_64.rpm Red Hat Enterprise Linux Client (v. 7): Source: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el7_1.src.rpm x86_64: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el7_1.src.rpm x86_64: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el7_1.src.rpm ppc64: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el7_1.ppc64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el7_1.ppc64.rpm java-1.6.0-openjdk-devel-1.6.0.36-1.13.8.1.el7_1.ppc64.rpm s390x: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el7_1.s390x.rpm java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el7_1.s390x.rpm java-1.6.0-openjdk-devel-1.6.0.36-1.13.8.1.el7_1.s390x.rpm x86_64: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el7_1.ppc64.rpm java-1.6.0-openjdk-demo-1.6.0.36-1.13.8.1.el7_1.ppc64.rpm java-1.6.0-openjdk-javadoc-1.6.0.36-1.13.8.1.el7_1.ppc64.rpm java-1.6.0-openjdk-src-1.6.0.36-1.13.8.1.el7_1.ppc64.rpm s390x: java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el7_1.s390x.rpm java-1.6.0-openjdk-demo-1.6.0.36-1.13.8.1.el7_1.s390x.rpm java-1.6.0-openjdk-javadoc-1.6.0.36-1.13.8.1.el7_1.s390x.rpm java-1.6.0-openjdk-src-1.6.0.36-1.13.8.1.el7_1.s390x.rpm x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el7_1.src.rpm x86_64: java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.36-1.13.8.1.el7_1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-2590 https://access.redhat.com/security/cve/CVE-2015-2601 https://access.redhat.com/security/cve/CVE-2015-2621 https://access.redhat.com/security/cve/CVE-2015-2625 https://access.redhat.com/security/cve/CVE-2015-2628 https://access.redhat.com/security/cve/CVE-2015-2632 https://access.redhat.com/security/cve/CVE-2015-2808 https://access.redhat.com/security/cve/CVE-2015-4000 https://access.redhat.com/security/cve/CVE-2015-4731 https://access.redhat.com/security/cve/CVE-2015-4732 https://access.redhat.com/security/cve/CVE-2015-4733 https://access.redhat.com/security/cve/CVE-2015-4748 https://access.redhat.com/security/cve/CVE-2015-4749 https://access.redhat.com/security/cve/CVE-2015-4760 https://access.redhat.com/security/updates/classification/#important https://bugzilla.redhat.com/show_bug.cgi?id=1207101#c11 https://bugzilla.redhat.com/show_bug.cgi?id=1223211#c33 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVulvzXlSAg2UNWIIRAmaeAJoCxD34LErxdkOHHsYpS21hu8NJ7ACgnbxy AM58F212G/DZWyApoAfiS38= =UmAX -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . This may allow remote disclosure of information. Do the following to mitigate the logjam issue in HP-UX Firefox and Thunderbird: HP-UX Firefox browser: Visit about:config in the Firefox browser Search for ssl3 and disable DHE_EXPORT ciphers by setting below preferences values to false. security.ssl3.dhe_rsa_aes_128_sha security.ssl3.dhe_rsa_aes_256_sha Restart the browser HP-UX Thunderbird: Select "Preferences" from the "Edit" menu Select "Advanced" Tab and then click on "Config Editor" button Search for security.ssl3.dhe_rsa_aes and disable DHE_EXPORT ciphers by setting below preference values to false. Description: Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Future updates may raise this limit to 1024 bits. The nss and nss-util packages have been upgraded to upstream versions 3.19.1. The upgraded versions provide a number of bug fixes and enhancements over the previous versions. Bugs fixed (https://bugzilla.redhat.com/): 1223211 - CVE-2015-4000 LOGJAM: TLS connections which support export grade DHE key-exchange are vulnerable to MITM attacks 6

AFFECTED PRODUCTS