OpenSSL Security Advisory
openssl.org
OpenSSL Security Advisory
1–10 of 112 posts
Re: OpenSSL Security Advisory
#2The relevant commit (fix): https://github.com/openssl/openssl/commit/e408c09bbf7c3057bd...
Edit: This is only the commit for the HIGH severity CVE-2016-6304.
Re: OpenSSL Security Advisory
#3The relevant commit (fix): https://github.com/openssl/openssl/commit/e408c09bbf7c3057bd... Edit: This is only the commit for the HIGH severity CVE-2016-6304.
That's just one of many commits related to today's advisory.
https://security-tracker.debian.org/tracker/source-package/o... has a good overview of each issue with links to commits etc on each CVE entry.
Re: OpenSSL Security Advisory
#4My first reaction: This never ends, does it?
Second reaction: Security is notoriously hard, nice that people are looking at the code and being thorough, it's for the collective best.
Re: OpenSSL Security Advisory
#5if i understand correctly this one is relevant to certificate issuers that publish certificate revocation lists via the OCSP protocol; could be used for denial of service but not for hacking into the certificate issue, is that correct?
Also most bugs in OpenSSL seem to be during renegotiation of protocol zzzz defined by some obscure RFC that nobody really understands how to implement, is that correct? Why can't they simplify these protocols, do we really need these fancy renegotiation features?
Actually Daniel Bernstein says that over-complicating the protocols is a clever way to make sure that software infrastructure remains insecure.
https://cr.yp.to/talks/2014.10.18/slides-djb-20141018-a4.pdf
Re: OpenSSL Security Advisory
#6Luckily I moved everything to openbsd's libressl which is /mostly/ compatible.
I wonder if this bug affects them, typically the HIGH's haven't[0]
It really feels like every other week there is a bug in OpenSSL and after following along with the libressl blog I understand why- the code is an absolute mess[1]
[0] http://undeadly.org/cgi?action=article&sid=20150319145126
Re: OpenSSL Security Advisory
#7if i understand correctly this one is relevant to certificate issuers that publish certificate revocation lists via the OCSP protocol; could be used for denial of service but not for hacking into the certificate issue, is that correct? Also most bugs in OpenSSL seem to be during renegotiation of protocol zzzz defined by some obscure RFC that nobody really understands how to implement, is that correct? Why can't they…
AIUI this affects the code that handles the TLS extension with which a client tells the server that it supports OCSP stapling, so any server with an affected openssl version would be vulnerable.
Re: OpenSSL Security Advisory
#8Luckily I moved everything to openbsd's libressl which is /mostly/ compatible. I wonder if this bug affects them, typically the HIGH's haven't[0] It really feels like every other week there is a bug in OpenSSL and after following along with the libressl blog I understand why- the code is an absolute mess[1] [0] http://undeadly.org/cgi?action=article&sid=20150319145126 [1] http://opensslrampage.org/page/49
Not much seems to have happened in LibreSSL since the initial rage-sprint.
For now, watch this spot:
Re: OpenSSL Security Advisory
#9If it does not have a home page and a catchy name like "Heartbleed", then this bug does not exist.
Re: OpenSSL Security Advisory
#10My first reaction: This never ends, does it? Second reaction: Security is notoriously hard, nice that people are looking at the code and being thorough, it's for the collective best.
[deleted]