Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL Security Advisory

openssl.org

Post reply on HN
Print view View original

31–40 of 142 posts

Re: OpenSSL Security Advisory

#31

Post by d_theorist »

calpaterson wrote: post #20
marcosdumay wrote: post #17

Earlier quoted context omitted.

Unless you are using client side certificates, this one is not your problem. But everybody must upgrade their browsers ASAP.

Is that right? My reading of it is that this affects all cases where you verify the certificate

It's right and wrong.

It's wrong in that this is very much your problem. It's right in that there is nothing you can do about it except hope that all the people who might try to connect to your website are using a patched (or pre-broken) verison of OpenSSL.

Patching your server-side version of OpenSSL (while a good idea) will not solve the problem because certificate verification is done (as it must be) browser-side.

Re: OpenSSL Security Advisory

#32

Post by acqq »

We probably don't need to worry this time:

https://ma.ttias.be/openssl-cve-2015-1793-man-middle-attack/

"The vulnerability appears to exist only in OpenSSL releases that happened in June 2015 and later. That leaves a lot of Linux distributions relatively safe, since they haven't gotten an OpenSSL update in a while.

Red Hat, CentOS and Ubuntu appear to be entirely unaffected by this vulnerability, since they had no OpenSSL updates since June 2015."

Re: OpenSSL Security Advisory

#33

Post by tedunangst »

ultramancool wrote: post #28
calpaterson wrote: post #20

Earlier quoted context omitted.

Is that right? My reading of it is that this affects all cases where you verify the certificate

Yes and most web servers do not use client certificates and do not have any need to validate certificates.

Any proxy or loadbalancer that uses https should validate certificates, however.

Re: OpenSSL Security Advisory

#34

Post by tedunangst »

d_theorist wrote: post #27

So, updating server side OpenSSL will not close this vulnerability (for servers offering https-protected websites)? Is that correct? If I understand the advisory correctly then this means that somebody could set up a webserver with a specially-crafted certificate and pretend to be somebody else, assuming that the client is running a vulnerable version of OpenSSL. Is that right? I wish they would write these advisorie…

Yes, this is a client side bug.

Re: OpenSSL Security Advisory

#35

Post by kaeso »

pilif wrote: post #4

> OpenSSL will attempt to find an alternative certificate chain if the first attempt to build such a chain fails I think the latest big thing I've learned in my career is that trying to fix broken input data silently is always bad. Fixing stuff silently isn't helpful for the callers, it's very difficult to do and it produces additional code which also isn't running in the normal case, so it's much more likely to be b…

This seems to be a common opinion recently, see https://tools.ietf.org/html/draft-thomson-postel-was-wrong-0...

Re: OpenSSL Security Advisory

#36

Post by rjst »

pilif wrote: post #4

> OpenSSL will attempt to find an alternative certificate chain if the first attempt to build such a chain fails I think the latest big thing I've learned in my career is that trying to fix broken input data silently is always bad. Fixing stuff silently isn't helpful for the callers, it's very difficult to do and it produces additional code which also isn't running in the normal case, so it's much more likely to be b…

So true.

Re: OpenSSL Security Advisory

#38

Post by drzaiusapelord »

acqq wrote: post #32

We probably don't need to worry this time: https://ma.ttias.be/openssl-cve-2015-1793-man-middle-attack/ "The vulnerability appears to exist only in OpenSSL releases that happened in June 2015 and later. That leaves a lot of Linux distributions relatively safe, since they haven't gotten an OpenSSL update in a while. Red Hat, CentOS and Ubuntu appear to be entirely unaffected by this vulnerability, since they had no Op…

Christ, what a mess of a project. They inserted this after their big promise to do better after heartbleed?

No wonder distros take their time moving to a new version. I really hope one of the alternative SSL libraries get picked up by the major distros. This is embarrassing, especially for those of us who have to justify FOSS in our environment.

LibreSSL looks promising. Hopefully competition will mean better outcomes for such critical libraries.

Post reply on HN