Re: [CentOS] OpenSSL Update - not a security update???

On 03/07/2016 12:14 PM, James Washington wrote:

Hey all,

Sorry to jump in here but out of curiosity, has the patch actually been back ported to earlier versions of OpenSSL regarding the recent DROWN attack? I've checked the RPM change log and nothing's been mentioned relating to CVE-2016-0800 (I think that was the CVE number). Or is this thread not relating to that vulnerability?

Kind regards

Yes, this update addresses Drown .. but installing the update alone is not enough, you also have to turn off SSLv2

You can see how to do that for many different services here:

https://access.redhat.com/articles/1462183

And lots of info here:

https://access.redhat.com/security/vulnerabilities/drown