Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL Security Advisory

openssl.org

Post reply on HN
Print view View original

21–30 of 142 posts

Re: OpenSSL Security Advisory

#21

Post by ultramancool »

marcosdumay wrote: post #17
eatonphil wrote: post #6

I've got a few sites using OpenSSL certs; do I need to do anything?

Unless you are using client side certificates, this one is not your problem. But everybody must upgrade their browsers ASAP.

Well, Firefox and Chrome use NSS, IE uses SChannel. Not sure about Safari or mobile browsers, but I believe the majority of desktop browsers will be safe.

Re: OpenSSL Security Advisory

#23

Post by hackerhamza »

am a hacker looking for those who got old bank account in usa and canada td bank to load no upfront fee charge iload it we share it 5050 email me hamzaben.d@hackermail.com leave your phone number am a hacker looking for those who got old bank account in usa and canada td bank to load no upfront fee charge iload it we share it 5050 email me hamzaben.d@hackermail.com leave your phone number am a hacker looking for those who got old bank account in usa and canada td bank to load no upfront fee charge iload it we share it 5050 email me hamzaben.d@hackermail.com leave your phone number

Re: OpenSSL Security Advisory

#25

Post by hackerhamza »

am a hacker looking for those who got old bank account in usa and canada td bank to load no upfront fee charge iload it we share it 5050 email me hamzaben.d@hackermail.com leave your phone number am a hacker looking for those who got old bank account in usa and canada td bank to load no upfront fee charge iload it we share it 5050 email me hamzaben.d@hackermail.com leave your phone number

Re: OpenSSL Security Advisory

#27

Post by d_theorist »

So, updating server side OpenSSL will not close this vulnerability (for servers offering https-protected websites)? Is that correct?

If I understand the advisory correctly then this means that somebody could set up a webserver with a specially-crafted certificate and pretend to be somebody else, assuming that the client is running a vulnerable version of OpenSSL.

Is that right? I wish they would write these advisories in a slightly more helpful fashion.

Re: OpenSSL Security Advisory

#28

Post by ultramancool »

calpaterson wrote: post #20
marcosdumay wrote: post #17

Earlier quoted context omitted.

Unless you are using client side certificates, this one is not your problem. But everybody must upgrade their browsers ASAP.

Is that right? My reading of it is that this affects all cases where you verify the certificate

Yes and most web servers do not use client certificates and do not have any need to validate certificates.

Re: OpenSSL Security Advisory

#29

Post by amirmc »

jgrahamc wrote: post #15

Interesting part is that the bug was introduced in the latest versions and has been fixed by the person who inserted it :-) Bug added: https://github.com/openssl/openssl/commit/da084a5ec6cebd67ae... Bug removed: https://github.com/openssl/openssl/commit/2aacec8f4a5ba1b365... Although that's just the committer: https://twitter.com/agl__/status/619129579580469248

Yep, that the bug was recently introduced was implied from the notice they put out.

For interest, the line that was fixed from the first commit is:

https://github.com/openssl/openssl/commit/da084a5ec6cebd67ae...

Post reply on HN