{"cves":["CVE-2010-0433","CVE-2009-3245","CVE-2009-3555"],"cvss":0.0,"database_specific":{"severity":"IMPORTANT"},"description":"[0.9.8e-12.6]\n- fix CVE-2009-3245 - add missing bn_wexpand return checks (#570924)\n\n[0.9.8e-12.5]\n- fix CVE-2010-0433 - do not pass NULL princ to krb5_kt_get_entry which\n  in the RHEL-5 and newer versions will crash in such case (#569774)\n\n[0.9.8e-12.4]\n- do not disable SSLv2 in the renegotiation patch - SSLv2 does\n  not support renegotiation\n- allow unsafe renegotiation on clients with SSL_OP_LEGACY_SERVER_CONNECT\n\n[0.9.8e-12.3]\n- mention the RFC5746 in the CVE-2009-3555 doc\n\n[0.9.8e-12.2]\n- fix CVE-2009-3555 - support the safe renegotiation extension and\n  do not allow legacy renegotiation on the server by default (#533125)","id":"ELSA-2010-0162","ovalId":"oval:com.oracle.elsa:def:20100162","source":"oracle_linux","title":"ELSA-2010-0162:  openssl security update (IMPORTANT)","url":"https://linux.oracle.com/errata/ELSA-2010-0162.html"}