"OpenSSL 0-Length" how to fix this?
closed as unclear what you're asking by Rui F Ribeiro, muru, Stephen Kitt, Sparhawk, dr01 Jun 14 at 9:41
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
First, you find out the CVE number for this vulnerability. A quick bit of Googling tells me "OpenSSL 0-length" is CVE-2019-1559, published in February of this year.
Any enterprise-grade Linux distribution (or any other OS for that matter) should have a list of security patches/announcements by CVE numbers, or some other way to find out which security patches fix a vulnerability identified by a particular CVE.
There are also vendor-neutral vulnerability databases, like this one for example. They often include links to vendor-specific security announcements: find the announcement applicable to your distribution, and you'll have the exact information you need to fix the vulnerability in a maintainable way.
Vulnerability databases also include short descriptions of the nature of the vulnerability, if you need that: in this case, OpenSSL responds differently to different types of errors in received encrypted traffic, and if the attacker can detect this difference, it can be abused to decrypt encrypted data under some specific conditions.
From the description, you might guess that there could be two possible ways to fix this vulnerability: 1.) patch OpenSSL to have an uniform response to all decryption errors, or 2.) patch all OpenSSL-using applications to not disclose the type of decryption error to a possible attacker. Both are obviously desirable, but 1) provides a quick solution for many applications at once, and so it is likely to be the primary fix.
The vulnerability database also indicates that the vulnerability exists in OpenSSL versions starting from version 1.0.2 to version 1.0.2q. So you'll want to install an update for your OS that includes either OpenSSL 1.0.2r or greater, or any version of OpenSSL 1.0.2 that specifically says it includes a backported fix for CVE-2019-1559.