Join the community today
Register Now

Security September 2016: OpenSSL 1.0.2i & Updating Centmin Mod Nginx SSL Support

Discussion in 'CentOS, Redhat & Oracle Linux News' started by eva2000, Sep 22, 2016.

  1. eva2000

    eva2000 Administrator Staff Member

    30,968
    6,919
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +10,422
    Local Time:
    12:34 PM
    Nginx 1.13.x
    MariaDB 5.5

    OpenSSL 1.0.2i Release Information



    Update: 26/9/16 - OpenSSL 1.0.2j was released to patch 1.0.2i flaws introduced see Security - September 26, 2016: OpenSSL 1.0.2j Security Update & Centmin Mod Nginx Recompile | Centmin Mod Community

    OpenSSL folks are releasing OpenSSL 1.1.0a, 1.0.2i, and 1.0.1u security updates on September 22, 2016 https://www.openssl.org/news/secadv/20160922.txt. Centmin Mod 123.08stable only supports OpenSSL 1.0.2i for Nginx SSL. Centmin Mod 123.09beta01 supports both OpenSSL 1.1.0a and 1.0.2i for Nginx SSL. Example for updating Centmin Mod Nginx with OpenSSL 1.0.2i can be seen here.

    OpenSSL Security Vulnerabilitys Fixed include:
    • OCSP Status Request extension unbounded memory growth (CVE-2016-6304)
    • SSL_peek() hang on empty record (CVE-2016-6305)
    • SWEET32 Mitigation (CVE-2016-2183)
    • OOB write in MDC2_Update() (CVE-2016-6303)
    • Malformed SHA512 ticket DoS (CVE-2016-6302)
    • OOB write in BN_bn2dec() (CVE-2016-2182)
    • OOB read in TS_OBJ_print_bio() (CVE-2016-2180)
    • Pointer arithmetic undefined behaviour (CVE-2016-2177)
    • Constant time flag not preserved in DSA signing (CVE-2016-2178)
    • DTLS buffered message DoS (CVE-2016-2179)
    • DTLS replay protection DoS (CVE-2016-2181)
    • Certificate message OOB reads (CVE-2016-6306)
    • Excessive allocation of memory in tls_get_message_header() (CVE-2016-6307)
    • Excessive allocation of memory in dtls1_preprocess_fragment() (CVE-2016-6308)

    Notes:


    • Prior to Feb 25th, 2016, Centmin Mod Nginx from 1.2.3-eva2000.08 (123.08stable) onwards by default are compiled against LibreSSL 2.2 instead of OpenSSL 1.0.2i, so generally don't need updating for Centmin Mod Nginx side. But CentOS system OpenSSL may need updates.
    • After Feb 25th, 2016, Centmin Mod 123.08stable version of Nginx has switched back to being compiled against OpenSSL 1.0.2+ for out of box defaults due to Nginx 1.9.12 compatibility issues with LibreSSL. While 123.09beta01 has switched back to LibreSSL 2.4 branch.

    Centmin Mod LEMP Upgrade OpenSSL 1.0.2i



    For Centmin Mod LEMP stack 1.2.3-eva2000.08 stable and higher, there's 2 parts to updating OpenSSL - system YUM package back ported update + Nginx OpenSSL static compilation for front facing Nginx server and https/SSL.

    For Centmin Mod 1.2.3-eva2000.08 stable (123.08stable) and higher (including betas) you need to do 2 updates:
    1. System OpenSSL update for CentOS
    2. Nginx recompile with OPENSSL_VER='1.0.2i' variable set. Check your updated Centmin Mod centmin.sh to see if OPENSSL_VER='1.0.2i' is set. If not set, then you need to manually update and edit your server copy of by setting OPENSSL_VERSION='1.0.2i' in your persistent config file (create it if it doesn't exist) at /etc/centminmod/custom_config.inc and add to it
      Code (Text):
      OPENSSL_VERSION='1.0.2i'
    Centmin Mod Nginx doesn't use system OpenSSL and is compiled statically - check command below will return blank/nothing for Centmin Mod Nginx. There's a reason why Centmin Mod Nginx is compiled against a statically linked OpenSSL version.

    Code (Text):
     ldd `which nginx` | grep ssl


    will come back empty for Centmin Mod Nginx based servers.

    System OpenSSL update for CentOS



    Redhat/CentOS info for CVE-2016-6304 at least wouldn't apply to Centmin Mod Nginx - details here. But still check with yum update, to see if any OpenSSL updates are available.

    Usually Redhat and CentOS back port patches so you will see something like OpenSSL 1.0.1e-XX where XX is incremented version number with fixed patches. Will update this post once Redhat/CentOS have an updated YUM package.

    Also sometimes Redhat or CentOS system versions won't be affected by the OpenSSL source listed bugs/security issues. You have to read each CVE* listing on Red Hat and CentOS bug trackers to see if they apply or not.

    CentOS/Redhat system OpenSSL updates

    CentOS 7
    Code (Text):
    TBA
    


    CentOS 6
    Code (Text):
    openssl 1.0.1e-48.el6_8.3


    For CentOS 7
    Code (Text):
    rpm -qa --changelog openssl | head -n8
    TBA
    


    For CentOS 6

    CentOS system openssl update seems to be out for CentOS 6 - not yet for CentOS 7
    Code (Text):
    rpm -ql --changelog openssl | head -n13
    * Thu Sep 22 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48.3
    - fix CVE-2016-2177 - possible integer overflow
    - fix CVE-2016-2178 - non-constant time DSA operations
    - fix CVE-2016-2179 - further DoS issues in DTLS
    - fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio()
    - fix CVE-2016-2181 - DTLS1 replay protection and unprocessed records issue
    - fix CVE-2016-2182 - possible buffer overflow in BN_bn2dec()
    - fix CVE-2016-6302 - insufficient TLS session ticket HMAC length check
    - fix CVE-2016-6304 - unbound memory growth with OCSP status request
    - fix CVE-2016-6306 - certificate message OOB reads
    - mitigate CVE-2016-2183 - degrade all 64bit block ciphers and RC4 to
      112 bit effective strength
    - replace expired testing certificates


    For auto daily updates check out yum-cron for auto updates.

    Code (Text):
    yum list updates -q | grep openssl
    


    Code (Text):
    rpm -qa --changelog openssl | head -n11
    


    To update
    Code (Text):
    yum -y update

    Note: after system update you need to reboot your server to ensure all services which use OpenSSL also use the updated version.

    Nginx recompile with OPENSSL_VER='1.0.2i'



    • Prior to Feb 25th, 2016, Centmin Mod Nginx from 1.2.3-eva2000.08 (123.08stable) onwards by default are compiled against LibreSSL 2.2 instead of OpenSSL 1.0.2i, so generally don't need updating for Centmin Mod Nginx side. But CentOS system OpenSSL may need updates.
    • After Feb 25th, 2016, Centmin Mod 123.08stable version of Nginx has switched back to being compiled against OpenSSL 1.0.2+ for out of box defaults due to Nginx 1.9.12 compatibility issues with LibreSSL. While 123.09beta01 has switched back to LibreSSL 2.3 branch.
    To update if you are using OpenSSL and not the prior default Centmin Mod Nginx LibreSSL, edit your centmin.sh file variable for OPENSSL_VERSION. There's 2 ways to do that:
    1. Best way is to use centmin.sh menu option 23 submenu option 2 for auto updating Centmin Mod code as outlined at centminmod.com/upgrade.html and at https://community.centminmod.com/threads/new-08-beta-menu-option-updating-centmin-mod-via-git.3084/. If Centmin Mod code has been updated, that method will auto update centmin.sh to latest version which already has OPENSSL_VERSION='1.0.2i' set. After updating via git centmin.sh menu option 23 submenu options, verify in centmin.sh that OPENSSL_VERSION='1.0.2i' is set.
    2. If you do not have centmin.sh menu option 23 submenu option 1 for git environment setup or if centmin.sh doesn't have OPENSSL_VERSION='1.0.2i' set, then you need to manually update and edit your server copy of by setting OPENSSL_VERSION='1.0.2i' in your persistent config file (create it if it doesn't exist) at /etc/centminmod/custom_config.inc and add to it
      Code (Text):
      OPENSSL_VERSION='1.0.2i'
      Then run centmin.sh menu option 4 to recompile Nginx. When prompted select yes or no from YUM checks, select NO (really system OpenSSL update step above wouldn't be needed if you select yes to YUM checks here ;) ). Then when prompted specify Nginx version = 1.11.4 or newer. Let Nginx recompile run to completion, it should say Nginx installed successfully. Check if Nginx compiled against 1.0.2i using Nginx -V command
    You can tell if your Centmin Mod Nginx is using OpenSSL or LibreSSL via output of SSH command
    Code (Text):
    nginx -V


    If using LibreSSL, built with line will list such
    Code (Text):
    nginx -V
    nginx version: nginx/1.11.4
    built by clang 3.4.2 (tags/RELEASE_34/dot2-final)
    built with LibreSSL 2.4.2


    If using OpenSSL, built with line will list such
    Code (Text):
    nginx -V
    nginx version: nginx/1.11.4
    built by clang 3.4.2 (tags/RELEASE_34/dot2-final)
    built with OpenSSL 1.0.2i  22 Sep 2016
    
     
    Last edited: Sep 29, 2016
  2. eva2000

    eva2000 Administrator Staff Member

    30,968
    6,919
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +10,422
    Local Time:
    12:34 PM
    Nginx 1.13.x
    MariaDB 5.5
    seems OpenSSL 1.0.2i breaks Cloudflare chacha20 patching, so need to set in persistent config file /etc/centminmod/custom_config.inc the variable
    Code (Text):
    CLOUDFLARE_PATCHSSL='n'

    prior to running centmin.sh menu option 4 to recompile Nginx. Latest Centmin Mod 123.08stable and 123.09beta01 have added code to detect OpenSSL 1.0.2i and auto disable Cloudflare chacha20 patch by setting dynamically
    Code (Text):
    CLOUDFLARE_PATCHSSL='n'


    errors and issue logged at Patch fails with OpenSSL 1.0.2i · Issue #42 · cloudflare/sslconfig · GitHub

    Code (Text):
    ######################################################################
    Cloudflare ChaCha20 patch
    https://github.com/cloudflare/sslconfig/blob/master/patches/openssl__chacha20_poly1305_draft_and_rfc_ossl102g.patch
    only Android 5 will support ChaCha20 if using Cloudflare Patch
    ######################################################################
    2016-09-22 11:09:57 URL:https://raw.githubusercontent.com/cloudflare/sslconfig/master/patches/openssl__chacha20_poly1305_draft_and_rfc_ossl102g.patch [162942/162942] -> "openssl__chacha20_poly1305_draft_and_rfc_ossl102g.patch" [1]
    patching file Configure
    Hunk #1 succeeded at 150 (offset 4 lines).
    Hunk #2 succeeded at 714 (offset 4 lines).
    Hunk #3 succeeded at 757 (offset 4 lines).
    Hunk #4 succeeded at 1213 (offset 1 line).
    Hunk #5 succeeded at 1242 (offset 1 line).
    Hunk #6 succeeded at 1410 (offset 2 lines).
    Hunk #7 FAILED at 1561.
    Hunk #8 succeeded at 1754 (offset 11 lines).
    Hunk #9 succeeded at 1817 (offset 11 lines).
    Hunk #10 succeeded at 2216 (offset 11 lines).
    Hunk #11 succeeded at 2247 (offset 11 lines).
    1 out of 11 hunks FAILED -- saving rejects to file Configure.rej
    patching file Makefile.org
    Hunk #1 succeeded at 92 (offset 1 line).
    Hunk #2 succeeded at 150 (offset 1 line).
    Hunk #3 succeeded at 237 (offset 2 lines).
    patching file apps/speed.c
    patching file crypto/chacha20poly1305/Makefile
    patching file crypto/chacha20poly1305/asm/chacha20_avx.pl
    patching file crypto/chacha20poly1305/asm/chacha20_avx2.pl
    patching file crypto/chacha20poly1305/asm/poly1305_avx.pl
    patching file crypto/chacha20poly1305/asm/poly1305_avx2.pl
    patching file crypto/chacha20poly1305/asm/poly1305_x64.pl
    patching file crypto/chacha20poly1305/chacha20.c
    patching file crypto/chacha20poly1305/chacha20poly1305.h
    patching file crypto/chacha20poly1305/chapolytest.c
    patching file crypto/chacha20poly1305/poly1305.c
    patching file crypto/cryptlib.c
    patching file crypto/evp/Makefile
    Hunk #3 succeeded at 266 (offset 1 line).
    patching file crypto/evp/e_chacha20poly1305.c
    patching file crypto/evp/evp.h
    patching file ssl/s3_lib.c
    Hunk #1 succeeded at 2945 (offset 54 lines).
    Hunk #2 succeeded at 4195 (offset 54 lines).
    Hunk #3 succeeded at 4229 (offset 54 lines).
    Hunk #4 succeeded at 4251 (offset 54 lines).
    patching file ssl/ssl.h
    patching file ssl/ssl_ciph.c
    Hunk #2 succeeded at 364 (offset -1 lines).
    Hunk #3 succeeded at 436 (offset -1 lines).
    Hunk #4 succeeded at 591 (offset -1 lines).
    Hunk #5 succeeded at 812 (offset -1 lines).
    patching file ssl/ssl_locl.h
    patching file ssl/tls1.h
    patching file test/Makefile
    Hunk #1 FAILED at 71.
    Hunk #2 FAILED at 84.
    Hunk #3 FAILED at 98.
    Hunk #4 FAILED at 109.
    Hunk #5 succeeded at 150 (offset 5 lines).
    Hunk #6 succeeded at 380 with fuzz 2 (offset 14 lines).
    Hunk #7 succeeded at 570 with fuzz 2 (offset 20 lines).
    Hunk #8 succeeded at 660 (offset 39 lines).
    4 out of 8 hunks FAILED -- saving rejects to file test/Makefile.rej
    ######################################################################

    Code (Text):
    ccache gcc -I.. -I../.. -I../modes -I../asn1 -I../evp -I../../include  -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -m64 -DL_ENDIAN -O3 -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM   -c -o e_rc4_hmac_md5.o e_rc4_hmac_md5.c
    ccache gcc -I.. -I../.. -I../modes -I../asn1 -I../evp -I../../include  -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -m64 -DL_ENDIAN -O3 -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM   -c -o e_chacha20poly1305.o e_chacha20poly1305.c
    e_chacha20poly1305.c: In function 'EVP_chacha20_poly1305_cipher':
    e_chacha20poly1305.c:82:57: error: 'EVP_CHACHA20_POLY1305_CTX' has no member named 'poly_state'
         #define poly_update(c,i,l) CRYPTO_poly1305_update(&c->poly_state,i,l)
                                                             ^
    e_chacha20poly1305.c:228:9: note: in expansion of macro 'poly_update'
             poly_update(aead_ctx, in, inl);
             ^
    e_chacha20poly1305.c:251:9: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing]
             ((uint64_t *)(aead_ctx->nonce))[4]--;
     
    Last edited: Sep 22, 2016
  3. eva2000

    eva2000 Administrator Staff Member

    30,968
    6,919
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +10,422
    Local Time:
    12:34 PM
    Nginx 1.13.x
    MariaDB 5.5
    As Centmin Mod Nginx defaults to LibreSSL for SSL, if you want to use OpenSSL 1.0.2i with Nginx SSL, need to set in persistent config file at /etc/centminmod/custom_config.inc the following variable
    Code (Text):
    LIBRESSL_SWITCH='n'
    

    Then run centmin.sh menu option 4 to recompile Nginx.

    So update your Centmin Mod code as outlined at Upgrade Centmin Mod - CentminMod.com LEMP Nginx web stack for CentOS via centmin.sh menu option 23 submenu option 2 first
    Code (Text):
    --------------------------------------------------------
         Centmin Mod Menu 123.09beta01 centminmod.com   
    --------------------------------------------------------
    1).  Centmin Install
    2).  Add Nginx vhost domain
    3).  NSD setup domain name DNS
    4).  Nginx Upgrade / Downgrade
    5).  PHP Upgrade / Downgrade
    6).  XCache Re-install
    7).  APC Cache Re-install
    8).  XCache Install
    9).  APC Cache Install
    10). Memcached Server Re-install
    11). MariaDB 5.2/5.5 & 10.x Upgrade Sub-Menu
    12). Zend OpCache Install/Re-install
    13). Install/Reinstall Redis PHP Extension
    14). SELinux disable
    15). Install/Reinstall ImagicK PHP Extension
    16). Change SSHD Port Number
    17). Multi-thread compression: pigz,pbzip2,lbzip2...
    18). Suhosin PHP Extension install
    19). Install FFMPEG and FFMPEG PHP Extension
    20). NSD Install/Re-Install
    21). Update - Nginx + PHP-FPM + Siege
    22). Add Wordpress Nginx vhost + Cache Plugin
    23). Update Centmin Mod Code Base
    24). Exit
    --------------------------------------------------------
    Enter option [ 1 - 24 ] 23
    --------------------------------------------------------
    

    centmin.sh menu option 23 submenu option 2
    Code (Text):
    
    --------------------------------------------------------
            Centmin Mod Updater Sub-Menu              
    --------------------------------------------------------
    1). Setup Centmin Mod Github Environment
    2). Update Centmin Mod Current Branch
    3). Update Centmin Mod Newer Branch
    4). Exit
    --------------------------------------------------------
    Enter option [ 1 - 4 ] 2
    --------------------------------------------------------
    

    select 4 to exit out of submenu, select 24 to exit out of centmin.sh, then re-cd into /usr/local/src/centminmod and re-run centmin.sh menu option 4
    Code (Text):
    cd /usr/local/src/centminmod
    ./centmin.sh
    


    Or if you don't want to use centmin.sh menu option 23, you can do straight git pull update via
    Code (Text):
    cd /usr/local/src/centminmod
    git stash
    git pull
    ./centmin.sh
    


    FYI, this forum is now using Nginx 1.11.4 + OpenSSL 1.0.2i via LIBRESSL_SWITCH='n' based centmin.sh menu option 4 recompile

    Code (Text):
    --------------------------------------------------------
         Centmin Mod Menu 123.09beta01 centminmod.com   
    --------------------------------------------------------
    1).  Centmin Install
    2).  Add Nginx vhost domain
    3).  NSD setup domain name DNS
    4).  Nginx Upgrade / Downgrade
    5).  PHP Upgrade / Downgrade
    6).  XCache Re-install
    7).  APC Cache Re-install
    8).  XCache Install
    9).  APC Cache Install
    10). Memcached Server Re-install
    11). MariaDB 5.2/5.5 & 10.x Upgrade Sub-Menu
    12). Zend OpCache Install/Re-install
    13). Install/Reinstall Redis PHP Extension
    14). SELinux disable
    15). Install/Reinstall ImagicK PHP Extension
    16). Change SSHD Port Number
    17). Multi-thread compression: pigz,pbzip2,lbzip2...
    18). Suhosin PHP Extension install
    19). Install FFMPEG and FFMPEG PHP Extension
    20). NSD Install/Re-Install
    21). Update - Nginx + PHP-FPM + Siege
    22). Add Wordpress Nginx vhost + Cache Plugin
    23). Update Centmin Mod Code Base
    24). Exit
    --------------------------------------------------------
    Enter option [ 1 - 24 ] 4
    --------------------------------------------------------
    

    Code (Text):
    Do you want to run YUM install checks ?  [y/n]
    
    This will increase your upgrade duration time wise.
    Check the change log centminmod.com/changelog.html
    to see if any Nginx or PHP related new additions
    which require checking YUM prequisites are met.
    If no new additions made, you can skip the
    YUM install check to speed up upgrade time.
    
     [y/n]: n
    

    Code (Text):
    Nginx Upgrade - Would you like to continue? [y/n] y
    
    Install which version of Nginx? (version i.e. type 1.11.4): 1.11.4


    End result
    If your nginx -v output shows built with LibreSSL instead, then this OpenSSL 1.0.2i update doesn't apply to you. I'd expect LibreSSL 2.4.3 release soon for similar security fixes as right now LibreSSL 2.4.2 is latest still.
     
    Last edited: Sep 22, 2016
    • Like Like x 2
  4. bassie

    bassie Active Member

    573
    124
    43
    Apr 29, 2016
    Ratings:
    +378
    Local Time:
    3:34 AM
    • Informative Informative x 2
  5. eva2000

    eva2000 Administrator Staff Member

    30,968
    6,919
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +10,422
    Local Time:
    12:34 PM
    Nginx 1.13.x
    MariaDB 5.5
  6. eva2000

    eva2000 Administrator Staff Member

    30,968
    6,919
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +10,422
    Local Time:
    12:34 PM
    Nginx 1.13.x
    MariaDB 5.5
    LibreSSL 2.4.3 still not out but a bit on these latest OpenSSL vulnerabilities as it applies to LibreSSL 'Re: LibreSSL affected by OpenSSL security issues?' - MARC
     
  7. eva2000

    eva2000 Administrator Staff Member

    30,968
    6,919
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +10,422
    Local Time:
    12:34 PM
    Nginx 1.13.x
    MariaDB 5.5
    For CVE-2016-6304 vulnerability which is marked as high severity vulnerability more details at OpenSSL OCSP Status Request extension unbounded memory growth (CVE-2016-6304)
    So for CentOS system side is the 2nd part of Centmin Mod OpenSSL update (1st being Nginx recompile for OpenSSL 1.0.2i), Redhat/CentOS has CVE-2016-6304 - Red Hat Customer Portal

    So seems CentOS and Centmin Mod users might not be affected as OCSP is only being used in Centmin Mod Nginx and that uses it's own statically compiled OpenSSL 1.0.2i if you update as per above. Centmin Mod Nginx SSL doesn't use CentOS systems YUM bundled and installed OpenSSL 1.0.1e version.
     
  8. eva2000

    eva2000 Administrator Staff Member

    30,968
    6,919
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +10,422
    Local Time:
    12:34 PM
    Nginx 1.13.x
    MariaDB 5.5
  9. eva2000

    eva2000 Administrator Staff Member

    30,968
    6,919
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +10,422
    Local Time:
    12:34 PM
    Nginx 1.13.x
    MariaDB 5.5
  10. eva2000

    eva2000 Administrator Staff Member

    30,968
    6,919
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +10,422
    Local Time:
    12:34 PM
    Nginx 1.13.x
    MariaDB 5.5
    CentOS system openssl update seems to be out for CentOS 6 - not yet for CentOS 7
    Code (Text):
    rpm -ql --changelog openssl | head -n13
    * Thu Sep 22 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48.3
    - fix CVE-2016-2177 - possible integer overflow
    - fix CVE-2016-2178 - non-constant time DSA operations
    - fix CVE-2016-2179 - further DoS issues in DTLS
    - fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio()
    - fix CVE-2016-2181 - DTLS1 replay protection and unprocessed records issue
    - fix CVE-2016-2182 - possible buffer overflow in BN_bn2dec()
    - fix CVE-2016-6302 - insufficient TLS session ticket HMAC length check
    - fix CVE-2016-6304 - unbound memory growth with OCSP status request
    - fix CVE-2016-6306 - certificate message OOB reads
    - mitigate CVE-2016-2183 - degrade all 64bit block ciphers and RC4 to
      112 bit effective strength
    - replace expired testing certificates