Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

openssl.org

Post reply on HN
Print view View original

11–20 of 47 posts

Re: OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

#11

Post by jolmg »

erichdongubler wrote: post #4
nayuki wrote: post #3

What popular software contain these vulnerable versions of the OpenSSL library?

This is a good question. Also important to remember is that for many Linux distributions dynamically linked OpenSSL artifacts are what end up getting used by the vast majority of binaries.

Yeah, I was thinking by all of the binaries. I had forgotten that there's software that bundle it independently of the distro's library. Another comment mentioned docker images, and I've remembered that ruby also bundles it for its own use.

Re: OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

#12

Post by hannob »

chupa-chups wrote: post #10
detaro wrote: post #8

Earlier quoted context omitted.

SSH != SSL. EDIT: Expect web servers running HTTPS in modern configurations to be affected, and other TLS based protocols. SSH is fine.

Both SSH and SSL base on TLS. The leak in question has a problem > during or after a TLS 1.3 handshake Sure, openSSL is not SSH, but it is not unreasonable to assume this leak may affect web servers as well (e.g. by being based on the same underlying TLS implementation). "SSH != SSL" is a bit short to invalidate the assumption of the OP. I'd not be so sure this problem does not affect "web server X". https://en.wikip…

> Both SSH and SSL base on TLS

No.

Re: OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

#13

Post by detaro »

chupa-chups wrote: post #10
detaro wrote: post #8

Earlier quoted context omitted.

SSH != SSL. EDIT: Expect web servers running HTTPS in modern configurations to be affected, and other TLS based protocols. SSH is fine.

Both SSH and SSL base on TLS. The leak in question has a problem > during or after a TLS 1.3 handshake Sure, openSSL is not SSH, but it is not unreasonable to assume this leak may affect web servers as well (e.g. by being based on the same underlying TLS implementation). "SSH != SSL" is a bit short to invalidate the assumption of the OP. I'd not be so sure this problem does not affect "web server X". https://en.wikip…

The parent is asking if primarily servers exposing "SSH" are affected. I should be less glib though, fair enough. will edit.

Re: OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

#14

Post by [deleted] »

hannob wrote: post #12
chupa-chups wrote: post #10

Earlier quoted context omitted.

Both SSH and SSL base on TLS. The leak in question has a problem > during or after a TLS 1.3 handshake Sure, openSSL is not SSH, but it is not unreasonable to assume this leak may affect web servers as well (e.g. by being based on the same underlying TLS implementation). "SSH != SSL" is a bit short to invalidate the assumption of the OP. I'd not be so sure this problem does not affect "web server X". https://en.wikip…

> Both SSH and SSL base on TLS No.

[deleted]

Re: OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

#18

Post by vladsanchez »

snvzz wrote: post #15

Sure, let's continue to reward incompetence by further funding openssl. In a sane world, everybody would have switched to libressl ages ago.

I gather that LibreSSL has an (unintended) OpenSSL dependency?

"LibreSSL is composed of four parts:

- The openssl(1) utility, which provides tools for managing keys, certificates, etc. - libcrypto: a library of cryptography fundamentals - libssl: a TLS library, backwards-compatible with OpenSSL - libtls: a new TLS library, designed to make it easier to write foolproof application"

:shrug:

Re: OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

#19

Post by Avamander »

vladsanchez wrote: post #17

OpenSSL is the culprit of a MacPort installation issue (vde2) for which there is no maintainer. It exposes operational vulnerability to unmaintained open source software.

Lets be fair, unmaintained proprietary software has the same vulnerability.

Re: OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

#20

Post by notaplumber »

vladsanchez wrote: post #18
snvzz wrote: post #15

Sure, let's continue to reward incompetence by further funding openssl. In a sane world, everybody would have switched to libressl ages ago.

I gather that LibreSSL has an (unintended) OpenSSL dependency? "LibreSSL is composed of four parts: - The openssl(1) utility, which provides tools for managing keys, certificates, etc. - libcrypto: a library of cryptography fundamentals - libssl: a TLS library, backwards-compatible with OpenSSL - libtls: a new TLS library, designed to make it easier to write foolproof application" :shrug:

No, LibreSSL is a fork of OpenSSL that predates this vulnerability, it even predates the OpenSSL 1.1.x API break (some compatibility has since been added), and has an entirely separate and new TLS 1.3 implementation.

https://www.openbsd.org/papers/bsdcan2019-tls13.pdf (video: https://www.youtube.com/watch?v=MCVIBwGOwNY)

It maintains source compatibility with OpenSSL at an API and command-line level (e.g. openssl(1) utility).

LibreSSL cannot copy code from later versions of OpenSSL as they relicensed it under the Apache 2.0 license.

Post reply on HN