Skip to navigation

Security Advisory Important: java-1.6.0-openjdk security update

Advisory: RHSA-2013:0246-1
Type: Security Advisory
Severity: Important
Issued on: 2013-02-08
Last updated on: 2013-02-08
Affected Products: Red Hat Enterprise Linux (v. 5 server)
Red Hat Enterprise Linux Desktop (v. 5 client)
Red Hat Enterprise Linux EUS (v. 5.9.z server)
Red Hat Enterprise Linux Long Life (v. 5.9 server)
CVEs (cve.mitre.org): CVE-2013-0424
CVE-2013-0425
CVE-2013-0426
CVE-2013-0427
CVE-2013-0428
CVE-2013-0429
CVE-2013-0432
CVE-2013-0433
CVE-2013-0434
CVE-2013-0435
CVE-2013-0440
CVE-2013-0441
CVE-2013-0442
CVE-2013-0443
CVE-2013-0445
CVE-2013-0450
CVE-2013-1475
CVE-2013-1476
CVE-2013-1478
CVE-2013-1480

Details

Updated java-1.6.0-openjdk packages that fix several security issues are
now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

These packages provide the OpenJDK 6 Java Runtime Environment and the
OpenJDK 6 Software Development Kit.

Multiple improper permission check issues were discovered in the AWT,
CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java
application or applet could use these flaws to bypass Java sandbox
restrictions. (CVE-2013-0442, CVE-2013-0445, CVE-2013-0441, CVE-2013-1475,
CVE-2013-1476, CVE-2013-0429, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426,
CVE-2013-0428)

Multiple flaws were found in the way image parsers in the 2D and AWT
components handled image raster parameters. A specially-crafted image could
cause Java Virtual Machine memory corruption and, possibly, lead to
arbitrary code execution with the virtual machine privileges.
(CVE-2013-1478, CVE-2013-1480)

A flaw was found in the AWT component's clipboard handling code. An
untrusted Java application or applet could use this flaw to access
clipboard data, bypassing Java sandbox restrictions. (CVE-2013-0432)

The default Java security properties configuration did not restrict access
to certain com.sun.xml.internal packages. An untrusted Java application or
applet could use this flaw to access information, bypassing certain Java
sandbox restrictions. This update lists the whole package as restricted.
(CVE-2013-0435)

Multiple improper permission check issues were discovered in the Libraries,
Networking, and JAXP components. An untrusted Java application or applet
could use these flaws to bypass certain Java sandbox restrictions.
(CVE-2013-0427, CVE-2013-0433, CVE-2013-0434)

It was discovered that the RMI component's CGIHandler class used user
inputs in error messages without any sanitization. An attacker could use
this flaw to perform a cross-site scripting (XSS) attack. (CVE-2013-0424)

It was discovered that the SSL/TLS implementation in the JSSE component
did not properly enforce handshake message ordering, allowing an unlimited
number of handshake restarts. A remote attacker could use this flaw to
make an SSL/TLS server using JSSE consume an excessive amount of CPU by
continuously restarting the handshake. (CVE-2013-0440)

It was discovered that the JSSE component did not properly validate
Diffie-Hellman public keys. An SSL/TLS client could possibly use this flaw
to perform a small subgroup attack. (CVE-2013-0443)

This erratum also upgrades the OpenJDK package to IcedTea6 1.11.6. Refer to
the NEWS file, linked to in the References, for further information.

All users of java-1.6.0-openjdk are advised to upgrade to these updated
packages, which resolve these issues. All running instances of OpenJDK Java
must be restarted for the update to take effect.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Updated packages

Red Hat Enterprise Linux (v. 5 server)

SRPMS:
java-1.6.0-openjdk-1.6.0.0-1.33.1.11.6.el5_9.src.rpm
File outdated by:  RHSA-2013:1014
    MD5: e6ce94ac4d1626d4d909f4b7d3f0a499
SHA-256: 363316cae26c09feff380081056b8f84f6f6beccb1d6e1d8d8b050b1b70e3745
 
IA-32:
java-1.6.0-openjdk-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 01b58d41e4bd4fd6715ed26c637b43d4
SHA-256: aee4770993d4413c359d61ec321019bdc8dee20f118c98cb26c63c7f413438d4
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 5ffb1bf3322a10577203c466151a4481
SHA-256: 35caecf080fa9bd81e1d65ae608139fb420c576e39477a9ed1e8263e0e6b61c6
java-1.6.0-openjdk-demo-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 7a5e578d4d09008d93e95824785cf34c
SHA-256: 09be777b21f2af5ec4eb8e2eeb0ef18da90f08b23ffa0b8a6dabc6cb33a3a188
java-1.6.0-openjdk-devel-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 143e0378f15a5cd25d6769abbd9351cb
SHA-256: 77a942b9228170ec077dcad0364b0ee04071cb3f8b787328be580aca1e30fe87
java-1.6.0-openjdk-javadoc-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 082472c2a91e81a6e44e09067835038e
SHA-256: 49cf33fcc95b8f96d7114e0ac70a485e02e7e3e3c217ef66f2f4b3f07d53bf62
java-1.6.0-openjdk-src-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 5c3296934d4a51eb27c3e25ce8c4bd68
SHA-256: 9ab489007ed71443056301a77222c64ad940348d39d2ee60791ea4070694d798
 
x86_64:
java-1.6.0-openjdk-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 532018167b94ed479bb14a9800908aad
SHA-256: 1007697701121a74a587127353aa9ec93796f26c51118a4efce9729a5a377ef9
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 694d2899b90e8b7fc531de424e404326
SHA-256: d6dbee336e3b83a33732b4c444b73382fb353960d28d0ac4220fccbddae9196b
java-1.6.0-openjdk-demo-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 2614e6e00b6324a9bbdb4bfbad221d52
SHA-256: d82797996178e17ca4cdcc352c00ebf818a3a3a29c76e2ede2042c77588465cd
java-1.6.0-openjdk-devel-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 46bb2aaeb4e3c330f861edf3d5527f13
SHA-256: 89404bf4bd3229229cc63f5aec8b3d31cbe5a3c47d3d782b9c0f512dcf942166
java-1.6.0-openjdk-javadoc-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: d96ef6cd27de3b1d8d136ee20adbfca8
SHA-256: dd0e8b76b371db0746c7f746e148db3def613be9a223fbdccf34f79589cf4188
java-1.6.0-openjdk-src-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: a7fe80122e060f9b329b9b55af0684de
SHA-256: 1fca954b1ce97e0a7b052da7a5333c079f5ae8731c0f560934e5164cdce70583
 
Red Hat Enterprise Linux Desktop (v. 5 client)

SRPMS:
java-1.6.0-openjdk-1.6.0.0-1.33.1.11.6.el5_9.src.rpm
File outdated by:  RHSA-2013:1014
    MD5: e6ce94ac4d1626d4d909f4b7d3f0a499
SHA-256: 363316cae26c09feff380081056b8f84f6f6beccb1d6e1d8d8b050b1b70e3745
 
IA-32:
java-1.6.0-openjdk-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 01b58d41e4bd4fd6715ed26c637b43d4
SHA-256: aee4770993d4413c359d61ec321019bdc8dee20f118c98cb26c63c7f413438d4
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 5ffb1bf3322a10577203c466151a4481
SHA-256: 35caecf080fa9bd81e1d65ae608139fb420c576e39477a9ed1e8263e0e6b61c6
java-1.6.0-openjdk-demo-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 7a5e578d4d09008d93e95824785cf34c
SHA-256: 09be777b21f2af5ec4eb8e2eeb0ef18da90f08b23ffa0b8a6dabc6cb33a3a188
java-1.6.0-openjdk-devel-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 143e0378f15a5cd25d6769abbd9351cb
SHA-256: 77a942b9228170ec077dcad0364b0ee04071cb3f8b787328be580aca1e30fe87
java-1.6.0-openjdk-javadoc-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 082472c2a91e81a6e44e09067835038e
SHA-256: 49cf33fcc95b8f96d7114e0ac70a485e02e7e3e3c217ef66f2f4b3f07d53bf62
java-1.6.0-openjdk-src-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2014:0408
    MD5: 5c3296934d4a51eb27c3e25ce8c4bd68
SHA-256: 9ab489007ed71443056301a77222c64ad940348d39d2ee60791ea4070694d798
 
x86_64:
java-1.6.0-openjdk-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 532018167b94ed479bb14a9800908aad
SHA-256: 1007697701121a74a587127353aa9ec93796f26c51118a4efce9729a5a377ef9
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 694d2899b90e8b7fc531de424e404326
SHA-256: d6dbee336e3b83a33732b4c444b73382fb353960d28d0ac4220fccbddae9196b
java-1.6.0-openjdk-demo-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 2614e6e00b6324a9bbdb4bfbad221d52
SHA-256: d82797996178e17ca4cdcc352c00ebf818a3a3a29c76e2ede2042c77588465cd
java-1.6.0-openjdk-devel-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: 46bb2aaeb4e3c330f861edf3d5527f13
SHA-256: 89404bf4bd3229229cc63f5aec8b3d31cbe5a3c47d3d782b9c0f512dcf942166
java-1.6.0-openjdk-javadoc-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: d96ef6cd27de3b1d8d136ee20adbfca8
SHA-256: dd0e8b76b371db0746c7f746e148db3def613be9a223fbdccf34f79589cf4188
java-1.6.0-openjdk-src-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2014:0408
    MD5: a7fe80122e060f9b329b9b55af0684de
SHA-256: 1fca954b1ce97e0a7b052da7a5333c079f5ae8731c0f560934e5164cdce70583
 
Red Hat Enterprise Linux EUS (v. 5.9.z server)

SRPMS:
java-1.6.0-openjdk-1.6.0.0-1.33.1.11.6.el5_9.src.rpm
File outdated by:  RHSA-2013:1014
    MD5: e6ce94ac4d1626d4d909f4b7d3f0a499
SHA-256: 363316cae26c09feff380081056b8f84f6f6beccb1d6e1d8d8b050b1b70e3745
 
IA-32:
java-1.6.0-openjdk-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2013:1014
    MD5: 01b58d41e4bd4fd6715ed26c637b43d4
SHA-256: aee4770993d4413c359d61ec321019bdc8dee20f118c98cb26c63c7f413438d4
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2013:1014
    MD5: 5ffb1bf3322a10577203c466151a4481
SHA-256: 35caecf080fa9bd81e1d65ae608139fb420c576e39477a9ed1e8263e0e6b61c6
java-1.6.0-openjdk-demo-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2013:1014
    MD5: 7a5e578d4d09008d93e95824785cf34c
SHA-256: 09be777b21f2af5ec4eb8e2eeb0ef18da90f08b23ffa0b8a6dabc6cb33a3a188
java-1.6.0-openjdk-devel-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2013:1014
    MD5: 143e0378f15a5cd25d6769abbd9351cb
SHA-256: 77a942b9228170ec077dcad0364b0ee04071cb3f8b787328be580aca1e30fe87
java-1.6.0-openjdk-javadoc-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2013:1014
    MD5: 082472c2a91e81a6e44e09067835038e
SHA-256: 49cf33fcc95b8f96d7114e0ac70a485e02e7e3e3c217ef66f2f4b3f07d53bf62
java-1.6.0-openjdk-src-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2013:1014
    MD5: 5c3296934d4a51eb27c3e25ce8c4bd68
SHA-256: 9ab489007ed71443056301a77222c64ad940348d39d2ee60791ea4070694d798
 
x86_64:
java-1.6.0-openjdk-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2013:1014
    MD5: 532018167b94ed479bb14a9800908aad
SHA-256: 1007697701121a74a587127353aa9ec93796f26c51118a4efce9729a5a377ef9
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2013:1014
    MD5: 694d2899b90e8b7fc531de424e404326
SHA-256: d6dbee336e3b83a33732b4c444b73382fb353960d28d0ac4220fccbddae9196b
java-1.6.0-openjdk-demo-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2013:1014
    MD5: 2614e6e00b6324a9bbdb4bfbad221d52
SHA-256: d82797996178e17ca4cdcc352c00ebf818a3a3a29c76e2ede2042c77588465cd
java-1.6.0-openjdk-devel-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2013:1014
    MD5: 46bb2aaeb4e3c330f861edf3d5527f13
SHA-256: 89404bf4bd3229229cc63f5aec8b3d31cbe5a3c47d3d782b9c0f512dcf942166
java-1.6.0-openjdk-javadoc-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2013:1014
    MD5: d96ef6cd27de3b1d8d136ee20adbfca8
SHA-256: dd0e8b76b371db0746c7f746e148db3def613be9a223fbdccf34f79589cf4188
java-1.6.0-openjdk-src-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2013:1014
    MD5: a7fe80122e060f9b329b9b55af0684de
SHA-256: 1fca954b1ce97e0a7b052da7a5333c079f5ae8731c0f560934e5164cdce70583
 
Red Hat Enterprise Linux Long Life (v. 5.9 server)

SRPMS:
java-1.6.0-openjdk-1.6.0.0-1.33.1.11.6.el5_9.src.rpm
File outdated by:  RHSA-2013:1014
    MD5: e6ce94ac4d1626d4d909f4b7d3f0a499
SHA-256: 363316cae26c09feff380081056b8f84f6f6beccb1d6e1d8d8b050b1b70e3745
 
IA-32:
java-1.6.0-openjdk-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2013:1014
    MD5: 01b58d41e4bd4fd6715ed26c637b43d4
SHA-256: aee4770993d4413c359d61ec321019bdc8dee20f118c98cb26c63c7f413438d4
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2013:1014
    MD5: 5ffb1bf3322a10577203c466151a4481
SHA-256: 35caecf080fa9bd81e1d65ae608139fb420c576e39477a9ed1e8263e0e6b61c6
java-1.6.0-openjdk-demo-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2013:1014
    MD5: 7a5e578d4d09008d93e95824785cf34c
SHA-256: 09be777b21f2af5ec4eb8e2eeb0ef18da90f08b23ffa0b8a6dabc6cb33a3a188
java-1.6.0-openjdk-devel-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2013:1014
    MD5: 143e0378f15a5cd25d6769abbd9351cb
SHA-256: 77a942b9228170ec077dcad0364b0ee04071cb3f8b787328be580aca1e30fe87
java-1.6.0-openjdk-javadoc-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2013:1014
    MD5: 082472c2a91e81a6e44e09067835038e
SHA-256: 49cf33fcc95b8f96d7114e0ac70a485e02e7e3e3c217ef66f2f4b3f07d53bf62
java-1.6.0-openjdk-src-1.6.0.0-1.33.1.11.6.el5_9.i386.rpm
File outdated by:  RHSA-2013:1014
    MD5: 5c3296934d4a51eb27c3e25ce8c4bd68
SHA-256: 9ab489007ed71443056301a77222c64ad940348d39d2ee60791ea4070694d798
 
x86_64:
java-1.6.0-openjdk-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2013:1014
    MD5: 532018167b94ed479bb14a9800908aad
SHA-256: 1007697701121a74a587127353aa9ec93796f26c51118a4efce9729a5a377ef9
java-1.6.0-openjdk-debuginfo-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2013:1014
    MD5: 694d2899b90e8b7fc531de424e404326
SHA-256: d6dbee336e3b83a33732b4c444b73382fb353960d28d0ac4220fccbddae9196b
java-1.6.0-openjdk-demo-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2013:1014
    MD5: 2614e6e00b6324a9bbdb4bfbad221d52
SHA-256: d82797996178e17ca4cdcc352c00ebf818a3a3a29c76e2ede2042c77588465cd
java-1.6.0-openjdk-devel-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2013:1014
    MD5: 46bb2aaeb4e3c330f861edf3d5527f13
SHA-256: 89404bf4bd3229229cc63f5aec8b3d31cbe5a3c47d3d782b9c0f512dcf942166
java-1.6.0-openjdk-javadoc-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2013:1014
    MD5: d96ef6cd27de3b1d8d136ee20adbfca8
SHA-256: dd0e8b76b371db0746c7f746e148db3def613be9a223fbdccf34f79589cf4188
java-1.6.0-openjdk-src-1.6.0.0-1.33.1.11.6.el5_9.x86_64.rpm
File outdated by:  RHSA-2013:1014
    MD5: a7fe80122e060f9b329b9b55af0684de
SHA-256: 1fca954b1ce97e0a7b052da7a5333c079f5ae8731c0f560934e5164cdce70583
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

859140 - CVE-2013-0440 OpenJDK: CPU consumption DoS via repeated SSL ClientHello packets (JSSE, 7192393)
860652 - CVE-2013-1475 OpenJDK: IIOP type reuse sandbox bypass (CORBA, 8000540, SE-2012-01 Issue 50)
906813 - CVE-2013-0424 OpenJDK: RMI CGIHandler XSS issue (RMI, 6563318)
906892 - CVE-2013-0435 OpenJDK: com.sun.xml.internal.* not restricted packages (JAX-WS, 7201068)
906894 - CVE-2013-1478 OpenJDK: image parser insufficient raster parameter checks (2D, 8001972)
906899 - CVE-2013-0442 OpenJDK: insufficient privilege checking issue (AWT, 7192977)
906900 - CVE-2013-0445 OpenJDK: insufficient privilege checking issue (AWT, 8001057)
906904 - CVE-2013-1480 OpenJDK: image parser insufficient raster parameter checks (AWT, 8002325)
906911 - CVE-2013-0450 OpenJDK: RequiredModelMBean missing access control context checks (JMX, 8000537)
907207 - CVE-2013-0428 OpenJDK: reflection API incorrect checks for proxy classes (Libraries, 7197546, SE-2012-01 Issue 29)
907219 - CVE-2013-0432 OpenJDK: insufficient clipboard access premission checks (AWT, 7186952)
907340 - CVE-2013-0443 OpenJDK: insufficient Diffie-Hellman public key checks (JSSE, 7192392)
907344 - CVE-2013-0425 OpenJDK: logging insufficient access control checks (Libraries, 6664509)
907346 - CVE-2013-0426 OpenJDK: logging insufficient access control checks (Libraries, 6664528)
907453 - CVE-2013-0434 OpenJDK: loadPropertyFile missing restrictions (JAXP, 8001235)
907455 - CVE-2013-0427 OpenJDK: invalid threads subject to interrupts (Libraries, 6776941)
907456 - CVE-2013-0433 OpenJDK: InetSocketAddress serialization issue (Networking, 7201071)
907457 - CVE-2013-1476 OpenJDK: missing ValueHandlerImpl class constructor access restriction (CORBA, 8000631)
907458 - CVE-2013-0441 OpenJDK: missing serialization restriction (CORBA, 7201066)
907460 - CVE-2013-0429 OpenJDK: PresentationManager incorrectly shared (CORBA, 7141694)


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/