Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL Security Advisory

openssl.org

Post reply on HN
Print view View original

11–20 of 112 posts

Re: OpenSSL Security Advisory

#11

Post by throwaway7767 »

dijit wrote: post #6

Luckily I moved everything to openbsd's libressl which is /mostly/ compatible. I wonder if this bug affects them, typically the HIGH's haven't[0] It really feels like every other week there is a bug in OpenSSL and after following along with the libressl blog I understand why- the code is an absolute mess[1] [0] http://undeadly.org/cgi?action=article&sid=20150319145126 [1] http://opensslrampage.org/page/49

The interesting thing about LibreSSL is that it's got such a halo around it that people just assume it's not vulnerable to any OpenSSL bugs.

Practically every OpenSSL bug posted here gets the standard "Luckily LibreSSL isn't affected by this kind of thing" response. On a couple of occasions I've taken the bait and linked to the LibreSSL source to show that the relevant bits are in fact not changed at all, so they were both vulnerable.

Not saying LibreSSL isn't doing good stuff, I just wish people would actually check if it's affected before using any opportunity to jump on the let's-hate-on-openssl bandwagon.

(I haven't looked into these bugs in the LibreSSL code since I don't have time for it right now, but I'm sure some message is forthcoming).

Re: OpenSSL Security Advisory

#13

Post by hannob »

VeejayRampay wrote: post #4

My first reaction: This never ends, does it? Second reaction: Security is notoriously hard, nice that people are looking at the code and being thorough, it's for the collective best.

What never ends? Low severity memory safety bugs in a large C codebase? Probably not.

You may think this is a lot. It's not. This largely appears a lot because OpenSSL treats a lot of very low impact issues as vulnerabilities. A lot of other projecs would rather start arguing that this is not exploitable, should never get a CVE etc. This is a good sign. OpenSSL is taking security seriously by treating even low impact things as vulns. More severe stuff still happens, but I'm pretty positive there is a decline in severe issues.

Re: OpenSSL Security Advisory

#14

Post by AlyssaRowan »

MichaelMoser123 wrote: post #5

if i understand correctly this one is relevant to certificate issuers that publish certificate revocation lists via the OCSP protocol; could be used for denial of service but not for hacking into the certificate issue, is that correct? Also most bugs in OpenSSL seem to be during renegotiation of protocol zzzz defined by some obscure RFC that nobody really understands how to implement, is that correct? Why can't they…

Simplifying the protocol, making it easier to analyse (and prove) and especially removing legacy things we know are troublesome is the main goal of the draft TLS 1.3: now already live and rolled out across CloudFlare and Chrome, and which removes such things as renegotiation, all non-AEAD ciphersuites, MD5, SHA-1, static RSA, and many of the other classic TLS bugbears which keep bearing interesting vulnerabilities.

Which isn't to say the optional (but usefully fast) 0-RTT mode might not introduce a few more, for those lackadaisical devs who inevitably ignore all dire warnings and abuse it for non-idempotent requests like POSTs (or GETs that do something - bad idea!).

But even if it's not how I would have designed it afresh (the Noise Protocol Framework from Trevor Perrin is how I would have designed a new connection protocol now) it's still a big improvement over previous TLS/SSL iterations and a drastic enough change it probably deserves to be called TLS 2.0.

Re: OpenSSL Security Advisory

#15

Post by tajen »

0x0 wrote: post #3
_jomo wrote: post #2

The relevant commit (fix): https://github.com/openssl/openssl/commit/e408c09bbf7c3057bd... Edit: This is only the commit for the HIGH severity CVE-2016-6304.

That's just one of many commits related to today's advisory. https://security-tracker.debian.org/tracker/source-package/o... has a good overview of each issue with links to commits etc on each CVE entry.

I don't understand your link, it lists this issue under "Open Issues" – Does that mean the fix for Debian isn't published yet?

Re: OpenSSL Security Advisory

#16

Post by discreditable »

Yuioup wrote: post #9

If it does not have a home page and a catchy name like "Heartbleed", then this bug does not exist.

There's one in the advisory for CVE-2016-2183 - https://sweet32.info.

I'm trying to track these sites, mainly for my own amusement: https://github.com/KeenRivals/Bugsite-Index

Re: OpenSSL Security Advisory

#17

Post by OrpheanBeholder »

throwaway7767 wrote: post #11
dijit wrote: post #6

Luckily I moved everything to openbsd's libressl which is /mostly/ compatible. I wonder if this bug affects them, typically the HIGH's haven't[0] It really feels like every other week there is a bug in OpenSSL and after following along with the libressl blog I understand why- the code is an absolute mess[1] [0] http://undeadly.org/cgi?action=article&sid=20150319145126 [1] http://opensslrampage.org/page/49

The interesting thing about LibreSSL is that it's got such a halo around it that people just assume it's not vulnerable to any OpenSSL bugs. Practically every OpenSSL bug posted here gets the standard "Luckily LibreSSL isn't affected by this kind of thing" response. On a couple of occasions I've taken the bait and linked to the LibreSSL source to show that the relevant bits are in fact not changed at all, so they wer…

No one is claiming that LibreSSL has fixed all the OpenSSL bugs, the parent certainly didn't. LibreSSL has historically been vulnerable to less of the bugs than OpenSSL and, for a long time, none of the sev:high bugs.

Re: OpenSSL Security Advisory

#18

Post by easytiger »

VeejayRampay wrote: post #4

My first reaction: This never ends, does it? Second reaction: Security is notoriously hard, nice that people are looking at the code and being thorough, it's for the collective best.

What never ends? Dramatic over reaction for the ske of internet prosthelytising

Re: OpenSSL Security Advisory

#19

Post by 0x0 »

tajen wrote: post #15
0x0 wrote: post #3

Earlier quoted context omitted.

That's just one of many commits related to today's advisory. https://security-tracker.debian.org/tracker/source-package/o... has a good overview of each issue with links to commits etc on each CVE entry.

I don't understand your link, it lists this issue under "Open Issues" – Does that mean the fix for Debian isn't published yet?

That's correct. Knowing Debian, there's probably an update coming in the next few hours.

Re: OpenSSL Security Advisory

#20

Post by anon1385 »

OrpheanBeholder wrote: post #17
throwaway7767 wrote: post #11

Earlier quoted context omitted.

The interesting thing about LibreSSL is that it's got such a halo around it that people just assume it's not vulnerable to any OpenSSL bugs. Practically every OpenSSL bug posted here gets the standard "Luckily LibreSSL isn't affected by this kind of thing" response. On a couple of occasions I've taken the bait and linked to the LibreSSL source to show that the relevant bits are in fact not changed at all, so they wer…

No one is claiming that LibreSSL has fixed all the OpenSSL bugs, the parent certainly didn't. LibreSSL has historically been vulnerable to less of the bugs than OpenSSL and, for a long time, none of the sev:high bugs.

>none of the sev:high bugs.

Well it looks like that has just changed: https://marc.info/?l=libressl&m=147454940615412&w=2

Post reply on HN