41–50 of 142 posts
It´s for old version. For example actual debian not affected. https://security-tracker.debian.org/tracker/CVE-2015-1793
all quibbling aside, most people would probably need an explanation to understand your post, as the recent version of debian is indeed affected, as in debian-unstable (sid)'s openssl.
Earlier quoted context omitted.
Unless you are using client side certificates, this one is not your problem. But everybody must upgrade their browsers ASAP.
Well, Firefox and Chrome use NSS, IE uses SChannel. Not sure about Safari or mobile browsers, but I believe the majority of desktop browsers will be safe.
Earlier quoted context omitted.
Is that right? My reading of it is that this affects all cases where you verify the certificate
Yes and most web servers do not use client certificates and do not have any need to validate certificates.
So, updating server side OpenSSL will not close this vulnerability (for servers offering https-protected websites)? Is that correct? If I understand the advisory correctly then this means that somebody could set up a webserver with a specially-crafted certificate and pretend to be somebody else, assuming that the client is running a vulnerable version of OpenSSL. Is that right? I wish they would write these advisorie…
Yes, this is a client side bug.
(clearly there are far fewer of those around but they do exist)
> OpenSSL will attempt to find an alternative certificate chain if the first attempt to build such a chain fails I think the latest big thing I've learned in my career is that trying to fix broken input data silently is always bad. Fixing stuff silently isn't helpful for the callers, it's very difficult to do and it produces additional code which also isn't running in the normal case, so it's much more likely to be b…
This seems to be a common opinion recently, see https://tools.ietf.org/html/draft-thomson-postel-was-wrong-0...
Why has the adoption of alternative SSL software been so low. We have libressl, boringssl, something from Amazon? Very few Linux distributions seem interested in shipping alternative SSL software.