On 03/07/2016 12:14 PM, James Washington wrote: > Hey all, > > Sorry to jump in here but out of curiosity, has the patch actually been back > ported to earlier versions of OpenSSL regarding the recent DROWN attack? I've > checked the RPM change log and nothing's been mentioned relating to > CVE-2016-0800 (I think that was the CVE number). Or is this thread not > relating to that vulnerability? > > Kind regards
Yes, this update addresses Drown .. but installing the update alone is not enough, you also have to turn off SSLv2 You can see how to do that for many different services here: https://access.redhat.com/articles/1462183 And lots of info here: https://access.redhat.com/security/vulnerabilities/drown
signature.asc
Description: OpenPGP digital signature
_______________________________________________ CentOS mailing list CentOS@centos.org https://lists.centos.org/mailman/listinfo/centos
