QID 671109

The openssl toolkit provides support for secure communications between machines.
Openssl includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols.
security fix(es): the tls protocol 1.2 and earlier, when a dhe_export ciphersuite is enabled on a server but not on a client, does not properly convey a dhe_export choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a clienthello with dhe replaced by dhe_export and then rewriting a serverhello with dhe_export replaced by dhe, aka the "logjam" issue.(cve-2015-4000) the dsa_sign_setup function in crypto/dsa/dsa_ossl.c in openssl through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a dsa private key via a timing side-channel attack.(cve-2016-2178) while parsing an ipaddressfamily extension in an x.509 certificate, it is possible to do a one-byte overread.
This would result in an incorrect text display of the certificate.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

An arbitrary attacker may exploit this vulnerability to compromise the system.