This is supposedly the commit which fixes the bug https://github.com/openssl/openssl/commit/3df6aed7826640d944...
[deleted]
Patch OpenSSL on November 1 to avoid “critical” security vulnerability
151–160 of 217 posts
Re: Patch OpenSSL on November 1 to avoid “critical” security vulnerability
#152Earlier quoted context omitted.
This is the challenge with embargoed disclosures: they have to be as generic as possible, to prevent people from sniffing the bug out.
I’m curious if someone is going to come forward with it diffed out anyways…
The idea/hope/point of the embargo is not keep the issue secret forever, but to keep it secret long enough to allow fixes to be released and that most people can update when/before the details become widely known.
I wouldn't be surprised if there's a "proper announcement" of the actual issue shortly after patches are widely available.
Re: Patch OpenSSL on November 1 to avoid “critical” security vulnerability
#153Earlier quoted context omitted.
So what do you propose is the alternative? Not tell you about the vulnerability at all until a patch is released? Publish all the details about the vulnerability before a patch is available? Seriously, what are you complaining about?
I just want actionable information is all. If I have to wait a couple days, fine. Giving me vague information I can't do anything with is useless.
I spent a few minutes checking my cmdb for openssl3, and have allocated 30 minutes on Tuesday to upgrade the few machines that have openssl3.
When corporate infosec starts to panic, probably about Thursday based on the jndi issue, I'll be able to point them to our log which shows how it was handled.
Re: Patch OpenSSL on November 1 to avoid “critical” security vulnerability
#154Here's the official place where these are announced, if you feel a little uneasy getting urgent security advisories from tweets and blogs: https://mta.openssl.org/mailman/listinfo/openssl-announce
Your point stands, but FWIW, this is actually Globalsign GMO[0], one of the largest TLS certificate authorities (CA's), so certainly they have a vested interest in making sure OpenSSL is secure. (Globalsign also partnered with CloudFlare for TLS certificates[1])
0. https://en.wikipedia.org/wiki/GlobalSign
1. https://techcrunch.com/2012/11/01/cloudflare-globalsign-make...
Re: Patch OpenSSL on November 1 to avoid “critical” security vulnerability
#155Earlier quoted context omitted.
"be prepared to update affected systems at $point_in_time" seems actionable to me. You for some reason thinking that such a warning doesn't warrant taking the recommended action doesn't mean it isn't actionable, it means you choose to ignore it.
An update is nothing special that I have to be prepared for. I do it all the time across all my systems, and it's largely automated. If a single update is such a burden that you must prepare days in advance for then perhaps there's room to improve the processes.
"I'm good at DevOps and everyone else should be too", feels tangential, and isn't going to help you when your banking session gets compromised because your bank wasn't prepared to roll this out through any expedited process versus their regulatory compliant, slow process.
(As an example/thought experiment. I make no claims about the vulnerability at hand.)
Re: Patch OpenSSL on November 1 to avoid “critical” security vulnerability
#156Re: Patch OpenSSL on November 1 to avoid “critical” security vulnerability
#157Earlier quoted context omitted.
An update is nothing special that I have to be prepared for. I do it all the time across all my systems, and it's largely automated. If a single update is such a burden that you must prepare days in advance for then perhaps there's room to improve the processes.
"I'm good at DevOps and everyone else should be too", feels tangential, and isn't going to help you when your banking session gets compromised because your bank wasn't prepared to roll this out through any expedited process versus their regulatory compliant, slow process. (As an example/thought experiment. I make no claims about the vulnerability at hand.)
I don't know anything about the update processes banks use. I would hope they wouldn't have to jump through hoops to apply a security update. Didn't they learn this already?
Re: Patch OpenSSL on November 1 to avoid “critical” security vulnerability
#158When I execute an ldd at /usr/bin/ssh I get libssl.so.10 => /lib64/libssl.so.10 libssl3.so => /lib64/libssl3.so libnss3.so => /lib64/libnss3.so What puzzles me is that I am using libssl.so.10 and libssl3.so at the same time. libssl3.so belongs to the nss package and not to the openssl package. Am I affected?
It is very unlikely that this affects OpenSSH regardless. Only the cryptographic primitives are used from OpenSSL, and none of the complexity of the SSL functions. The cryptographic functions themselves are small and extremely well tested.
OpenSSH (or commonly used variants thereof?) supports X.509 certificates, would they really reimplement that can of worms instead of using already linked libssl functions? Especially since on OpenSSH's home platform libssl is LibreSSL which they consider safer than OpenSSL.
Also, there already was one OpenSSL 3 crypto primitive caused vuln or at least security relevant bug in OpenSSH this year: https://thehackernews.com/2022/06/openssh-to-release-securit...
Re: Patch OpenSSL on November 1 to avoid “critical” security vulnerability
#159Earlier quoted context omitted.
"be prepared to update affected systems at $point_in_time" seems actionable to me. You for some reason thinking that such a warning doesn't warrant taking the recommended action doesn't mean it isn't actionable, it means you choose to ignore it.
An update is nothing special that I have to be prepared for. I do it all the time across all my systems, and it's largely automated. If a single update is such a burden that you must prepare days in advance for then perhaps there's room to improve the processes.
ok, so the actionable thing is "make a note to check for and run updates on Nov 1, even though it might a public holiday for you" and you're done. actionable != lots of effort, but I still appreciate a warning if I'm supposed to work on a holiday.
And yes, plenty places are not at the point where this is a "press button and done" activity, even if it should be. (e.g. pretty much everyone who is buying any kind of "appliance" and isn't just running open-source stuff now knows to go check with vendors)
Re: Patch OpenSSL on November 1 to avoid “critical” security vulnerability
#160Ubuntu 22.04 & RHEL 9 are the major distros impacted. Docker images built on ubuntu:latest will also be impacted. The latest releases of Alpine/Debian/AL2 are all not impacted, they use 1.1.x lineage.
What if you're using using the 1.0.x lineage? Does this vulnerability specifically impact you? ducks and covers
From the article:
>If you’re using version 1.1.1, this vulnerability doesn’t affect you, but there is a 1.1.1 update coming on Tuesday as well, version 1.1.1s, which you’re still going to need to update to anyway so you might as well schedule some time on Tuesday, too.