{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Updated OpenSSL packages are available that fix a potential timing-based\nattack and a modified Bleichenbacher attack.\n\n[Updated 30 May 2003]\nAdded missing i686 packages.",
            title: "Topic",
         },
         {
            category: "general",
            text: "OpenSSL is a commercial-grade, full-featured, open source toolkit that\nimplements the Secure Sockets Layer (SSL v2/v3) and Transport Layer\nSecurity (TLS v1) protocols, and provides a full-strength general purpose\ncryptography library.\n\nResearchers discovered a timing attack on RSA keys. Applications making\nuse of OpenSSL are generally vulnerable to such an attack, unless RSA\nblinding has been turned on. OpenSSL does not use RSA blinding by default\nand most applications do not enable RSA blinding.\n\nA local or remote attacker could use this attack to obtain the server's\nprivate key by determining factors using timing differences on (1) the\nnumber of extra reductions during Montgomery reduction, and (2) the use of\ndifferent integer multiplication algorithms (Karatsuba and normal).\n\nIn order for an attack to be sucessful, an attacker must have good\nnetwork conditions that allow small changes in timing to be reliably\nobserved.\n\nAdditionally, the SSL and TLS components for OpenSSL allow remote attackers\nto perform an unauthorized RSA private key operation via a modified\nBleichenbacher attack. This attack (also known as the Klima-Pokorny-Rosa\nattack) uses a large number of SSL or TLS connections using PKCS #1 v1.5\npadding to cause OpenSSL to leak information regarding the relationship\nbetween ciphertext and the associated plaintext.\n\nThese erratum packages contain a patch provided by the OpenSSL group that\nenables RSA blinding by default, and protects against the\nKlima-Pokorny-Rosa attack.\n\nBecause server applications are affected by these vulnerabilities, we\nadvise users to restart all services that use OpenSSL functionality or,\nalternatively, reboot their systems after installing these updates.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2003:102",
            url: "https://access.redhat.com/errata/RHSA-2003:102",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf",
            url: "http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf",
         },
         {
            category: "external",
            summary: "http://eprint.iacr.org/2003/052/",
            url: "http://eprint.iacr.org/2003/052/",
         },
         {
            category: "external",
            summary: "86206",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=86206",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_102.json",
         },
      ],
      title: "Red Hat Security Advisory: openssl security update",
      tracking: {
         current_release_date: "2024-11-21T22:42:57+00:00",
         generator: {
            date: "2024-11-21T22:42:57+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.1",
            },
         },
         id: "RHSA-2003:102",
         initial_release_date: "2003-03-31T12:00:00+00:00",
         revision_history: [
            {
               date: "2003-03-31T12:00:00+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2003-03-31T00:00:00+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-11-21T22:42:57+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
                        product: {
                           name: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
                           product_id: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:2.1::as",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Linux Advanced Workstation 2.1",
                        product: {
                           name: "Red Hat Linux Advanced Workstation 2.1",
                           product_id: "Red Hat Linux Advanced Workstation 2.1",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:2.1::aw",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux ES version 2.1",
                        product: {
                           name: "Red Hat Enterprise Linux ES version 2.1",
                           product_id: "Red Hat Enterprise Linux ES version 2.1",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:2.1::es",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux WS version 2.1",
                        product: {
                           name: "Red Hat Enterprise Linux WS version 2.1",
                           product_id: "Red Hat Enterprise Linux WS version 2.1",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:2.1::ws",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Enterprise Linux",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2003-0131",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1616975",
            },
         ],
         notes: [
            {
               category: "description",
               text: "The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the \"Klima-Pokorny-Rosa attack.\"",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "security flaw",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Enterprise Linux 4 and 5 are not vulnerable to this issue as they both contain a backported patch.",
               title: "Statement",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
               "Red Hat Enterprise Linux ES version 2.1",
               "Red Hat Enterprise Linux WS version 2.1",
               "Red Hat Linux Advanced Workstation 2.1",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2003-0131",
            },
            {
               category: "external",
               summary: "RHBZ#1616975",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1616975",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2003-0131",
               url: "https://www.cve.org/CVERecord?id=CVE-2003-0131",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2003-0131",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2003-0131",
            },
         ],
         release_date: "2003-03-19T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2003-03-31T12:00:00+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
               product_ids: [
                  "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
                  "Red Hat Enterprise Linux ES version 2.1",
                  "Red Hat Enterprise Linux WS version 2.1",
                  "Red Hat Linux Advanced Workstation 2.1",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2003:102",
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "security flaw",
      },
      {
         cve: "CVE-2003-0147",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1616986",
            },
         ],
         notes: [
            {
               category: "description",
               text: "OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms (\"Karatsuba\" and normal).",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "security flaw",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
               title: "Statement",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
               "Red Hat Enterprise Linux ES version 2.1",
               "Red Hat Enterprise Linux WS version 2.1",
               "Red Hat Linux Advanced Workstation 2.1",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2003-0147",
            },
            {
               category: "external",
               summary: "RHBZ#1616986",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1616986",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2003-0147",
               url: "https://www.cve.org/CVERecord?id=CVE-2003-0147",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2003-0147",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2003-0147",
            },
         ],
         release_date: "2003-03-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2003-03-31T12:00:00+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
               product_ids: [
                  "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
                  "Red Hat Enterprise Linux ES version 2.1",
                  "Red Hat Enterprise Linux WS version 2.1",
                  "Red Hat Linux Advanced Workstation 2.1",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2003:102",
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "security flaw",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Updated versions of cross-platform Stronghold 4 are available to fix a\nnumber of vulnerabilities in OpenSSL and Apache.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Stronghold 4 contains various open source technologies such as OpenSSL and\nApache. A number of issues have been found in versions of these projects:\n\nResearchers discovered a timing attack on RSA keys that affects OpenSSL.  \nA local or remote attacker could use this attack to obtain the server's\nprivate key by determining factors using timing differences on (1) the\nnumber of extra reductions during Montgomery reduction and (2) the use of\ndifferent integer multiplication algorithms (Karatsuba and normal).\nStronghold does not enable RSA blinding by default and is, therefore,\nvulnerable to this attack.\n\nThe SSL and TLS components for OpenSSL allow remote attackers to perform an\nunauthorized RSA private key operation via a modified Bleichenbacher\nattack. This attack (also known as the Klima-Pokorny-Rosa attack) uses a\nlarge number of SSL or TLS connections, using PKCS #1 v1.5 padding, and\ncauses OpenSSL to leak information regarding the relationship between\nciphertext and the associated plaintext.\n\nVersions of Apache 1.3 before 1.3.25 do not filter terminal escape\nsequences from access logs, which could make it easier for attackers to\ninsert those sequences into terminal emulators containing vulnerabilities\nrelated to escape sequences.\n\nThese erratum packages contain a patch provided by the OpenSSL group that\nenables RSA blinding by default, thereby protecting against the\nKlima-Pokorny-Rosa attack, and a patch to filter escape sequences from\nApache access logs.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2003:116",
            url: "https://access.redhat.com/errata/RHSA-2003:116",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "http://www.openssl.org/news/secadv_20030319.txt",
            url: "http://www.openssl.org/news/secadv_20030319.txt",
         },
         {
            category: "external",
            summary: "http://www.openssl.org/news/secadv_20030317.txt",
            url: "http://www.openssl.org/news/secadv_20030317.txt",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_116.json",
         },
      ],
      title: "Red Hat Security Advisory: apache, openssl security update for Stronghold",
      tracking: {
         current_release_date: "2024-11-21T22:43:00+00:00",
         generator: {
            date: "2024-11-21T22:43:00+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.1",
            },
         },
         id: "RHSA-2003:116",
         initial_release_date: "2003-03-28T13:43:00+00:00",
         revision_history: [
            {
               date: "2003-03-28T13:43:00+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2003-03-28T00:00:00+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-11-21T22:43:00+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Stronghold 4",
                        product: {
                           name: "Red Hat Stronghold 4",
                           product_id: "Red Hat Stronghold 4",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:stronghold:4",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Stronghold Cross Platform",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2003-0083",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1616961",
            },
         ],
         notes: [
            {
               category: "description",
               text: "Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences, a different vulnerability than CVE-2003-0020.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "security flaw",
               title: "Vulnerability summary",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Stronghold 4",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2003-0083",
            },
            {
               category: "external",
               summary: "RHBZ#1616961",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1616961",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2003-0083",
               url: "https://www.cve.org/CVERecord?id=CVE-2003-0083",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2003-0083",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2003-0083",
            },
         ],
         release_date: "2003-02-24T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2003-03-28T13:43:00+00:00",
               details: "Fixed Stronghold 4 packages are now available via the update agent service; run\n\n$ bin/agent\n\nfrom the Stronghold 4 install root to upgrade an existing Stronghold 4\ninstallation to the new package versions. After upgrading Stronghold, the\nserver must be completely restarted by running the following commands from\nthe install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nsee http://stronghold.redhat.com/support/upgrade-sh4",
               product_ids: [
                  "Red Hat Stronghold 4",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2003:116",
            },
         ],
         title: "security flaw",
      },
      {
         cve: "CVE-2003-0131",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1616975",
            },
         ],
         notes: [
            {
               category: "description",
               text: "The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the \"Klima-Pokorny-Rosa attack.\"",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "security flaw",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Enterprise Linux 4 and 5 are not vulnerable to this issue as they both contain a backported patch.",
               title: "Statement",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Stronghold 4",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2003-0131",
            },
            {
               category: "external",
               summary: "RHBZ#1616975",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1616975",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2003-0131",
               url: "https://www.cve.org/CVERecord?id=CVE-2003-0131",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2003-0131",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2003-0131",
            },
         ],
         release_date: "2003-03-19T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2003-03-28T13:43:00+00:00",
               details: "Fixed Stronghold 4 packages are now available via the update agent service; run\n\n$ bin/agent\n\nfrom the Stronghold 4 install root to upgrade an existing Stronghold 4\ninstallation to the new package versions. After upgrading Stronghold, the\nserver must be completely restarted by running the following commands from\nthe install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nsee http://stronghold.redhat.com/support/upgrade-sh4",
               product_ids: [
                  "Red Hat Stronghold 4",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2003:116",
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "security flaw",
      },
      {
         cve: "CVE-2003-0147",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1616986",
            },
         ],
         notes: [
            {
               category: "description",
               text: "OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms (\"Karatsuba\" and normal).",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "security flaw",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
               title: "Statement",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Stronghold 4",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2003-0147",
            },
            {
               category: "external",
               summary: "RHBZ#1616986",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1616986",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2003-0147",
               url: "https://www.cve.org/CVERecord?id=CVE-2003-0147",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2003-0147",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2003-0147",
            },
         ],
         release_date: "2003-03-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2003-03-28T13:43:00+00:00",
               details: "Fixed Stronghold 4 packages are now available via the update agent service; run\n\n$ bin/agent\n\nfrom the Stronghold 4 install root to upgrade an existing Stronghold 4\ninstallation to the new package versions. After upgrading Stronghold, the\nserver must be completely restarted by running the following commands from\nthe install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nsee http://stronghold.redhat.com/support/upgrade-sh4",
               product_ids: [
                  "Red Hat Stronghold 4",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2003:116",
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "security flaw",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Updated versions of Stronghold 3.0 that fix two OpenSSL vulnerabilities are\nnow available.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Stronghold 3 contains a number of open source technologies including\nOpenSSL.  Two issues in OpenSSL have recently been discovered:\n\nOpenSSL is a commercial-grade, full-featured, and open source toolkit that\nimplements Secure Sockets Layer (SSL v2/v3) and Transport Layer\nSecurity (TLS v1) protocols.  It also implements a full-strength general \npurpose cryptography library.\n\nResearchers have discovered a timing attack on RSA keys. Applications\nmaking use of OpenSSL are generally vulnerable to such an attack, unless\nRSA blinding has been turned on. OpenSSL does not use RSA blinding by\ndefault and most applications do not enable RSA blinding. \n\nA local or remote attacker could use this attack to obtain the server's\nprivate key.  This could be done by determining factors using timing\ndifferences on:\n\n(1) The number of extra reductions during Montgomery reduction\n\n(2) The use of different integer multiplication algorithms (\"Karatsuba\" and\nnormal)\n\nIn order for an attack to be successful, an attacker must have good\nnetwork conditions that allow small changes in timing to be reliably\nobserved.\n\nAdditionally, the SSL and TLS components for OpenSSL allow remote attackers\nto perform an unauthorized RSA private key operation via a modified\nBleichenbacher attack. This attack uses a large number of SSL or TLS\nconnections, using PKCS #1 v1.5 padding, and causes OpenSSL to leak\ninformation regarding the relationship between ciphertext and the\nassociated plaintext.  This is also known as the \"Klima-Pokorny-Rosa attack.\"\n\nThese erratum packages contain a patch provided by the OpenSSL group that\nenables RSA blinding by default and protects against\nKlima-Pokorny-Rosa attacks.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2003:117",
            url: "https://access.redhat.com/errata/RHSA-2003:117",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_117.json",
         },
      ],
      title: "Red Hat Security Advisory: openssl security update for Stronghold",
      tracking: {
         current_release_date: "2024-11-21T22:43:04+00:00",
         generator: {
            date: "2024-11-21T22:43:04+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.1",
            },
         },
         id: "RHSA-2003:117",
         initial_release_date: "2003-04-15T13:13:00+00:00",
         revision_history: [
            {
               date: "2003-04-15T13:13:00+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2003-03-25T00:00:00+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-11-21T22:43:04+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Stronghold 3",
                        product: {
                           name: "Red Hat Stronghold 3",
                           product_id: "Red Hat Stronghold 3",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:stronghold:3",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Stronghold Cross Platform",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2003-0131",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1616975",
            },
         ],
         notes: [
            {
               category: "description",
               text: "The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the \"Klima-Pokorny-Rosa attack.\"",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "security flaw",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Enterprise Linux 4 and 5 are not vulnerable to this issue as they both contain a backported patch.",
               title: "Statement",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Stronghold 3",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2003-0131",
            },
            {
               category: "external",
               summary: "RHBZ#1616975",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1616975",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2003-0131",
               url: "https://www.cve.org/CVERecord?id=CVE-2003-0131",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2003-0131",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2003-0131",
            },
         ],
         release_date: "2003-03-19T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2003-04-15T13:13:00+00:00",
               details: "We have backported the security fixes for the versions of OpenSSL included\nin Stronghold 3. Stronghold 3.0 build code 3022 is now available, includes\nthese fixes, and can be downloaded from:\n\nhttp://stronghold.redhat.com/sh3/\n\nFor information on how to upgrade between releases of Stronghold 3.0, see:\n\nhttp://stronghold.redhat.com/support/upgrade-sh3.xml",
               product_ids: [
                  "Red Hat Stronghold 3",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2003:117",
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "security flaw",
      },
      {
         cve: "CVE-2003-0147",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1616986",
            },
         ],
         notes: [
            {
               category: "description",
               text: "OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms (\"Karatsuba\" and normal).",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "security flaw",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
               title: "Statement",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Stronghold 3",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2003-0147",
            },
            {
               category: "external",
               summary: "RHBZ#1616986",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1616986",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2003-0147",
               url: "https://www.cve.org/CVERecord?id=CVE-2003-0147",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2003-0147",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2003-0147",
            },
         ],
         release_date: "2003-03-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2003-04-15T13:13:00+00:00",
               details: "We have backported the security fixes for the versions of OpenSSL included\nin Stronghold 3. Stronghold 3.0 build code 3022 is now available, includes\nthese fixes, and can be downloaded from:\n\nhttp://stronghold.redhat.com/sh3/\n\nFor information on how to upgrade between releases of Stronghold 3.0, see:\n\nhttp://stronghold.redhat.com/support/upgrade-sh3.xml",
               product_ids: [
                  "Red Hat Stronghold 3",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2003:117",
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "security flaw",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Updated OpenSSL packages that fix potential timing-based and modified\nBleichenbacher attacks are available for Red Hat Linux on IBM iSeries and\npSeries systems.",
            title: "Topic",
         },
         {
            category: "general",
            text: "OpenSSL is a commercial-grade, full-featured, and open source toolkit that \nimplements Secure Sockets Layer (SSL v2/v3) and Transport Layer\nSecurity (TLS v1) protocols as well as a full-strength general purpose\ncryptography library.\n\nIn a paper, Brice Canvel, Alain Hiltgen, Serge Vaudenay, and Martin\nVuagnoux describe and demonstrate a timing-based attack on CBC ciphersuites\nin SSL and TLS. An active attacker may be able to use timing observations\nto distinguish between two different error cases: cipher padding errors and\nMAC verification errors. Over multiple connections this can leak\nsufficient information to make it possible to retrieve the plaintext of a\ncommon, fixed block.\n\nIn order for an attack to be sucessful, an attacker must be able to act as\na man-in-the-middle to intercept and modify multiple connections, which all\ninvolve a common fixed plaintext block (such as a password), and have good\nnetwork conditions that allow small changes in timing to be reliably\nobserved.\n\nResearchers discovered a timing attack on RSA keys.  Applications making\nuse of OpenSSL are generally vulnerable to such an attack, unless RSA\nblinding has been turned on.  OpenSSL does not use RSA blinding by default\nand most applications do not enable RSA blinding.  \n\nA local or remote attacker could use this attack to obtain the server's\nprivate key by determining factors using timing differences on (1) the\nnumber of extra reductions during Montgomery reduction, and (2) the use of\ndifferent integer multiplication algorithms (\"Karatsuba\" and normal).\n\nIn order for an attack to be sucessful, an attacker must have good\nnetwork conditions allowing small changes in timing to be reliably\nobserved.\n\nAdditionally, the SSL and TLS components for OpenSSL allow remote attackers\nto perform an unauthorized RSA private key operation via a modified\nBleichenbacher attack. This attack uses a large number of SSL or TLS\nconnections, using PKCS #1 v1.5 padding, and causes OpenSSL to leak\ninformation regarding the relationship between ciphertext and the\nassociated plaintext, aka the \"Klima-Pokorny-Rosa attack.\"\n\nThese erratum packages contain patches provided by the OpenSSL group that\nenable RSA blinding by default and protect against the other vulnerabilities.\n\nBecause server applications are affected by these vulnerabilities, users\nare advised to restart all services that use OpenSSL functionality, or\nreboot their systems after installing these updates.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2003:205",
            url: "https://access.redhat.com/errata/RHSA-2003:205",
         },
         {
            category: "external",
            summary: "http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf",
            url: "http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf",
         },
         {
            category: "external",
            summary: "http://eprint.iacr.org/2003/052/",
            url: "http://eprint.iacr.org/2003/052/",
         },
         {
            category: "external",
            summary: "86112",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=86112",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_205.json",
         },
      ],
      title: "Red Hat Security Advisory: : : : Updated OpenSSL packages fix vulnerabilities",
      tracking: {
         current_release_date: "2024-11-21T22:43:08+00:00",
         generator: {
            date: "2024-11-21T22:43:08+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.1",
            },
         },
         id: "RHSA-2003:205",
         initial_release_date: "2003-06-23T17:37:00+00:00",
         revision_history: [
            {
               date: "2003-06-23T17:37:00+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2003-06-23T00:00:00+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-11-21T22:43:08+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Linux 7.1",
                        product: {
                           name: "Red Hat Linux 7.1",
                           product_id: "Red Hat Linux 7.1",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:linux:7.1",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Linux",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2003-0078",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1616956",
            },
         ],
         notes: [
            {
               category: "description",
               text: "ssl3_get_record in s3_pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC computation if an incorrect block cipher padding is used, which causes an information leak (timing discrepancy) that may make it easier to launch cryptographic attacks that rely on distinguishing between padding and MAC verification errors, possibly leading to extraction of the original plaintext, aka the \"Vaudenay timing attack.\"",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "security flaw",
               title: "Vulnerability summary",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Linux 7.1",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2003-0078",
            },
            {
               category: "external",
               summary: "RHBZ#1616956",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1616956",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2003-0078",
               url: "https://www.cve.org/CVERecord?id=CVE-2003-0078",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2003-0078",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2003-0078",
            },
         ],
         release_date: "2003-02-19T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2003-06-23T17:37:00+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
               product_ids: [
                  "Red Hat Linux 7.1",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2003:205",
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "security flaw",
      },
      {
         cve: "CVE-2003-0131",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1616975",
            },
         ],
         notes: [
            {
               category: "description",
               text: "The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the \"Klima-Pokorny-Rosa attack.\"",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "security flaw",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Enterprise Linux 4 and 5 are not vulnerable to this issue as they both contain a backported patch.",
               title: "Statement",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Linux 7.1",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2003-0131",
            },
            {
               category: "external",
               summary: "RHBZ#1616975",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1616975",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2003-0131",
               url: "https://www.cve.org/CVERecord?id=CVE-2003-0131",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2003-0131",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2003-0131",
            },
         ],
         release_date: "2003-03-19T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2003-06-23T17:37:00+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
               product_ids: [
                  "Red Hat Linux 7.1",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2003:205",
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "security flaw",
      },
      {
         cve: "CVE-2003-0147",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1616986",
            },
         ],
         notes: [
            {
               category: "description",
               text: "OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms (\"Karatsuba\" and normal).",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "security flaw",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
               title: "Statement",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Linux 7.1",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2003-0147",
            },
            {
               category: "external",
               summary: "RHBZ#1616986",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1616986",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2003-0147",
               url: "https://www.cve.org/CVERecord?id=CVE-2003-0147",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2003-0147",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2003-0147",
            },
         ],
         release_date: "2003-03-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2003-06-23T17:37:00+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
               product_ids: [
                  "Red Hat Linux 7.1",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2003:205",
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "security flaw",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Updated versions of Stronghold 3.0 that fix two OpenSSL vulnerabilities are\nnow available.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Stronghold 3 contains a number of open source technologies including\nOpenSSL.  Two issues in OpenSSL have recently been discovered:\n\nOpenSSL is a commercial-grade, full-featured, and open source toolkit that\nimplements Secure Sockets Layer (SSL v2/v3) and Transport Layer\nSecurity (TLS v1) protocols.  It also implements a full-strength general \npurpose cryptography library.\n\nResearchers have discovered a timing attack on RSA keys. Applications\nmaking use of OpenSSL are generally vulnerable to such an attack, unless\nRSA blinding has been turned on. OpenSSL does not use RSA blinding by\ndefault and most applications do not enable RSA blinding. \n\nA local or remote attacker could use this attack to obtain the server's\nprivate key.  This could be done by determining factors using timing\ndifferences on:\n\n(1) The number of extra reductions during Montgomery reduction\n\n(2) The use of different integer multiplication algorithms (\"Karatsuba\" and\nnormal)\n\nIn order for an attack to be successful, an attacker must have good\nnetwork conditions that allow small changes in timing to be reliably\nobserved.\n\nAdditionally, the SSL and TLS components for OpenSSL allow remote attackers\nto perform an unauthorized RSA private key operation via a modified\nBleichenbacher attack. This attack uses a large number of SSL or TLS\nconnections, using PKCS #1 v1.5 padding, and causes OpenSSL to leak\ninformation regarding the relationship between ciphertext and the\nassociated plaintext.  This is also known as the \"Klima-Pokorny-Rosa attack.\"\n\nThese erratum packages contain a patch provided by the OpenSSL group that\nenables RSA blinding by default and protects against\nKlima-Pokorny-Rosa attacks.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2003:117",
            url: "https://access.redhat.com/errata/RHSA-2003:117",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_117.json",
         },
      ],
      title: "Red Hat Security Advisory: openssl security update for Stronghold",
      tracking: {
         current_release_date: "2024-11-21T22:43:04+00:00",
         generator: {
            date: "2024-11-21T22:43:04+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.1",
            },
         },
         id: "RHSA-2003:117",
         initial_release_date: "2003-04-15T13:13:00+00:00",
         revision_history: [
            {
               date: "2003-04-15T13:13:00+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2003-03-25T00:00:00+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-11-21T22:43:04+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Stronghold 3",
                        product: {
                           name: "Red Hat Stronghold 3",
                           product_id: "Red Hat Stronghold 3",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:stronghold:3",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Stronghold Cross Platform",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2003-0131",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1616975",
            },
         ],
         notes: [
            {
               category: "description",
               text: "The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the \"Klima-Pokorny-Rosa attack.\"",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "security flaw",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Enterprise Linux 4 and 5 are not vulnerable to this issue as they both contain a backported patch.",
               title: "Statement",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Stronghold 3",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2003-0131",
            },
            {
               category: "external",
               summary: "RHBZ#1616975",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1616975",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2003-0131",
               url: "https://www.cve.org/CVERecord?id=CVE-2003-0131",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2003-0131",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2003-0131",
            },
         ],
         release_date: "2003-03-19T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2003-04-15T13:13:00+00:00",
               details: "We have backported the security fixes for the versions of OpenSSL included\nin Stronghold 3. Stronghold 3.0 build code 3022 is now available, includes\nthese fixes, and can be downloaded from:\n\nhttp://stronghold.redhat.com/sh3/\n\nFor information on how to upgrade between releases of Stronghold 3.0, see:\n\nhttp://stronghold.redhat.com/support/upgrade-sh3.xml",
               product_ids: [
                  "Red Hat Stronghold 3",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2003:117",
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "security flaw",
      },
      {
         cve: "CVE-2003-0147",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1616986",
            },
         ],
         notes: [
            {
               category: "description",
               text: "OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms (\"Karatsuba\" and normal).",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "security flaw",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
               title: "Statement",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Stronghold 3",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2003-0147",
            },
            {
               category: "external",
               summary: "RHBZ#1616986",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1616986",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2003-0147",
               url: "https://www.cve.org/CVERecord?id=CVE-2003-0147",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2003-0147",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2003-0147",
            },
         ],
         release_date: "2003-03-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2003-04-15T13:13:00+00:00",
               details: "We have backported the security fixes for the versions of OpenSSL included\nin Stronghold 3. Stronghold 3.0 build code 3022 is now available, includes\nthese fixes, and can be downloaded from:\n\nhttp://stronghold.redhat.com/sh3/\n\nFor information on how to upgrade between releases of Stronghold 3.0, see:\n\nhttp://stronghold.redhat.com/support/upgrade-sh3.xml",
               product_ids: [
                  "Red Hat Stronghold 3",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2003:117",
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "security flaw",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Updated OpenSSL packages are available that fix a potential timing-based\nattack and a modified Bleichenbacher attack.\n\n[Updated 30 May 2003]\nAdded missing i686 packages.",
            title: "Topic",
         },
         {
            category: "general",
            text: "OpenSSL is a commercial-grade, full-featured, open source toolkit that\nimplements the Secure Sockets Layer (SSL v2/v3) and Transport Layer\nSecurity (TLS v1) protocols, and provides a full-strength general purpose\ncryptography library.\n\nResearchers discovered a timing attack on RSA keys. Applications making\nuse of OpenSSL are generally vulnerable to such an attack, unless RSA\nblinding has been turned on. OpenSSL does not use RSA blinding by default\nand most applications do not enable RSA blinding.\n\nA local or remote attacker could use this attack to obtain the server's\nprivate key by determining factors using timing differences on (1) the\nnumber of extra reductions during Montgomery reduction, and (2) the use of\ndifferent integer multiplication algorithms (Karatsuba and normal).\n\nIn order for an attack to be sucessful, an attacker must have good\nnetwork conditions that allow small changes in timing to be reliably\nobserved.\n\nAdditionally, the SSL and TLS components for OpenSSL allow remote attackers\nto perform an unauthorized RSA private key operation via a modified\nBleichenbacher attack. This attack (also known as the Klima-Pokorny-Rosa\nattack) uses a large number of SSL or TLS connections using PKCS #1 v1.5\npadding to cause OpenSSL to leak information regarding the relationship\nbetween ciphertext and the associated plaintext.\n\nThese erratum packages contain a patch provided by the OpenSSL group that\nenables RSA blinding by default, and protects against the\nKlima-Pokorny-Rosa attack.\n\nBecause server applications are affected by these vulnerabilities, we\nadvise users to restart all services that use OpenSSL functionality or,\nalternatively, reboot their systems after installing these updates.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2003:102",
            url: "https://access.redhat.com/errata/RHSA-2003:102",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf",
            url: "http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf",
         },
         {
            category: "external",
            summary: "http://eprint.iacr.org/2003/052/",
            url: "http://eprint.iacr.org/2003/052/",
         },
         {
            category: "external",
            summary: "86206",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=86206",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_102.json",
         },
      ],
      title: "Red Hat Security Advisory: openssl security update",
      tracking: {
         current_release_date: "2024-11-21T22:42:57+00:00",
         generator: {
            date: "2024-11-21T22:42:57+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.1",
            },
         },
         id: "RHSA-2003:102",
         initial_release_date: "2003-03-31T12:00:00+00:00",
         revision_history: [
            {
               date: "2003-03-31T12:00:00+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2003-03-31T00:00:00+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-11-21T22:42:57+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
                        product: {
                           name: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
                           product_id: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:2.1::as",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Linux Advanced Workstation 2.1",
                        product: {
                           name: "Red Hat Linux Advanced Workstation 2.1",
                           product_id: "Red Hat Linux Advanced Workstation 2.1",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:2.1::aw",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux ES version 2.1",
                        product: {
                           name: "Red Hat Enterprise Linux ES version 2.1",
                           product_id: "Red Hat Enterprise Linux ES version 2.1",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:2.1::es",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux WS version 2.1",
                        product: {
                           name: "Red Hat Enterprise Linux WS version 2.1",
                           product_id: "Red Hat Enterprise Linux WS version 2.1",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:2.1::ws",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Enterprise Linux",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2003-0131",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1616975",
            },
         ],
         notes: [
            {
               category: "description",
               text: "The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the \"Klima-Pokorny-Rosa attack.\"",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "security flaw",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Enterprise Linux 4 and 5 are not vulnerable to this issue as they both contain a backported patch.",
               title: "Statement",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
               "Red Hat Enterprise Linux ES version 2.1",
               "Red Hat Enterprise Linux WS version 2.1",
               "Red Hat Linux Advanced Workstation 2.1",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2003-0131",
            },
            {
               category: "external",
               summary: "RHBZ#1616975",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1616975",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2003-0131",
               url: "https://www.cve.org/CVERecord?id=CVE-2003-0131",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2003-0131",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2003-0131",
            },
         ],
         release_date: "2003-03-19T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2003-03-31T12:00:00+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
               product_ids: [
                  "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
                  "Red Hat Enterprise Linux ES version 2.1",
                  "Red Hat Enterprise Linux WS version 2.1",
                  "Red Hat Linux Advanced Workstation 2.1",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2003:102",
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "security flaw",
      },
      {
         cve: "CVE-2003-0147",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1616986",
            },
         ],
         notes: [
            {
               category: "description",
               text: "OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms (\"Karatsuba\" and normal).",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "security flaw",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
               title: "Statement",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
               "Red Hat Enterprise Linux ES version 2.1",
               "Red Hat Enterprise Linux WS version 2.1",
               "Red Hat Linux Advanced Workstation 2.1",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2003-0147",
            },
            {
               category: "external",
               summary: "RHBZ#1616986",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1616986",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2003-0147",
               url: "https://www.cve.org/CVERecord?id=CVE-2003-0147",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2003-0147",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2003-0147",
            },
         ],
         release_date: "2003-03-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2003-03-31T12:00:00+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
               product_ids: [
                  "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
                  "Red Hat Enterprise Linux ES version 2.1",
                  "Red Hat Enterprise Linux WS version 2.1",
                  "Red Hat Linux Advanced Workstation 2.1",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2003:102",
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "security flaw",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Updated OpenSSL packages are available that fix a potential timing-based\nattack and a modified Bleichenbacher attack.\n\n[Updated 30 May 2003]\nAdded missing i686 packages.",
            title: "Topic",
         },
         {
            category: "general",
            text: "OpenSSL is a commercial-grade, full-featured, open source toolkit that\nimplements the Secure Sockets Layer (SSL v2/v3) and Transport Layer\nSecurity (TLS v1) protocols, and provides a full-strength general purpose\ncryptography library.\n\nResearchers discovered a timing attack on RSA keys. Applications making\nuse of OpenSSL are generally vulnerable to such an attack, unless RSA\nblinding has been turned on. OpenSSL does not use RSA blinding by default\nand most applications do not enable RSA blinding.\n\nA local or remote attacker could use this attack to obtain the server's\nprivate key by determining factors using timing differences on (1) the\nnumber of extra reductions during Montgomery reduction, and (2) the use of\ndifferent integer multiplication algorithms (Karatsuba and normal).\n\nIn order for an attack to be sucessful, an attacker must have good\nnetwork conditions that allow small changes in timing to be reliably\nobserved.\n\nAdditionally, the SSL and TLS components for OpenSSL allow remote attackers\nto perform an unauthorized RSA private key operation via a modified\nBleichenbacher attack. This attack (also known as the Klima-Pokorny-Rosa\nattack) uses a large number of SSL or TLS connections using PKCS #1 v1.5\npadding to cause OpenSSL to leak information regarding the relationship\nbetween ciphertext and the associated plaintext.\n\nThese erratum packages contain a patch provided by the OpenSSL group that\nenables RSA blinding by default, and protects against the\nKlima-Pokorny-Rosa attack.\n\nBecause server applications are affected by these vulnerabilities, we\nadvise users to restart all services that use OpenSSL functionality or,\nalternatively, reboot their systems after installing these updates.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2003:102",
            url: "https://access.redhat.com/errata/RHSA-2003:102",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf",
            url: "http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf",
         },
         {
            category: "external",
            summary: "http://eprint.iacr.org/2003/052/",
            url: "http://eprint.iacr.org/2003/052/",
         },
         {
            category: "external",
            summary: "86206",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=86206",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_102.json",
         },
      ],
      title: "Red Hat Security Advisory: openssl security update",
      tracking: {
         current_release_date: "2024-11-21T22:42:57+00:00",
         generator: {
            date: "2024-11-21T22:42:57+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.1",
            },
         },
         id: "RHSA-2003:102",
         initial_release_date: "2003-03-31T12:00:00+00:00",
         revision_history: [
            {
               date: "2003-03-31T12:00:00+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2003-03-31T00:00:00+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-11-21T22:42:57+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
                        product: {
                           name: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
                           product_id: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:2.1::as",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Linux Advanced Workstation 2.1",
                        product: {
                           name: "Red Hat Linux Advanced Workstation 2.1",
                           product_id: "Red Hat Linux Advanced Workstation 2.1",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:2.1::aw",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux ES version 2.1",
                        product: {
                           name: "Red Hat Enterprise Linux ES version 2.1",
                           product_id: "Red Hat Enterprise Linux ES version 2.1",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:2.1::es",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux WS version 2.1",
                        product: {
                           name: "Red Hat Enterprise Linux WS version 2.1",
                           product_id: "Red Hat Enterprise Linux WS version 2.1",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:2.1::ws",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Enterprise Linux",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2003-0131",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1616975",
            },
         ],
         notes: [
            {
               category: "description",
               text: "The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the \"Klima-Pokorny-Rosa attack.\"",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "security flaw",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Enterprise Linux 4 and 5 are not vulnerable to this issue as they both contain a backported patch.",
               title: "Statement",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
               "Red Hat Enterprise Linux ES version 2.1",
               "Red Hat Enterprise Linux WS version 2.1",
               "Red Hat Linux Advanced Workstation 2.1",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2003-0131",
            },
            {
               category: "external",
               summary: "RHBZ#1616975",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1616975",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2003-0131",
               url: "https://www.cve.org/CVERecord?id=CVE-2003-0131",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2003-0131",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2003-0131",
            },
         ],
         release_date: "2003-03-19T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2003-03-31T12:00:00+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
               product_ids: [
                  "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
                  "Red Hat Enterprise Linux ES version 2.1",
                  "Red Hat Enterprise Linux WS version 2.1",
                  "Red Hat Linux Advanced Workstation 2.1",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2003:102",
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "security flaw",
      },
      {
         cve: "CVE-2003-0147",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1616986",
            },
         ],
         notes: [
            {
               category: "description",
               text: "OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms (\"Karatsuba\" and normal).",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "security flaw",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
               title: "Statement",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
               "Red Hat Enterprise Linux ES version 2.1",
               "Red Hat Enterprise Linux WS version 2.1",
               "Red Hat Linux Advanced Workstation 2.1",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2003-0147",
            },
            {
               category: "external",
               summary: "RHBZ#1616986",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1616986",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2003-0147",
               url: "https://www.cve.org/CVERecord?id=CVE-2003-0147",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2003-0147",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2003-0147",
            },
         ],
         release_date: "2003-03-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2003-03-31T12:00:00+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
               product_ids: [
                  "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
                  "Red Hat Enterprise Linux ES version 2.1",
                  "Red Hat Enterprise Linux WS version 2.1",
                  "Red Hat Linux Advanced Workstation 2.1",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2003:102",
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "security flaw",
      },
   ],
}