Fix For CVE-2020-1971 On CentOS 6.10

Home » CentOS » Fix For CVE-2020-1971 On CentOS 6.10
CentOS 4 Comments

Hi,

While many of us were busy lately with upgrading CentOS 6 systems to CentOS 8, a lot of systems may still be running CentOS 6 and migrations came to a halt this week with the announcement of RedHats new direction for the CentOS project.

Since security updates for CentOS 6 are not provided anymore, I’ve decided to try my best to address CVE-2020-1971 and I welcome others to do the same for this and other new issues which may come up.

Attached patches:
openssl.spec.patch.gz openssl-1.0.1e-cve-2020-1971.patch.gz

Please let me know if you find any issues.

Regards, Simon

4 thoughts on - Fix For CVE-2020-1971 On CentOS 6.10

  • Simon Matter wrote:

    Thanks to Simon for doing this.

    I made my own patch which ended up the same as Simon’s apart from whitespace and formatting. It’s been deployed on a CentOS 6 system that can’t be upgraded yet due to… reasons. Seems to work in the limited testing I’ve done.

    Cheers,

    Ron

  • Thanks Ron for your feedback! It gives us more confidence that the patch is correct.

    I’m also using it on a number of systems without issues.

    Regards, Simon