OpenSSL Security Advisory • Hacker News Board

Re: OpenSSL Security Advisory

#11

Post by sneak » Thu, Jul 09, 2015, 1:14 PM UTC

agl++;

Re: OpenSSL Security Advisory

#12

Post by nkozyra » Thu, Jul 09, 2015, 1:14 PM UTC

eatonphil wrote: post #6

I've got a few sites using OpenSSL certs; do I need to do anything?

SSL does not necessarily mean OpenSSL is involved, but it could. Follow the advisories.

Re: OpenSSL Security Advisory

#13

Post by namtrac » Thu, Jul 09, 2015, 1:17 PM UTC

sneak wrote: post #11

agl++;

https://twitter.com/agl__/status/619129579580469248

Re: OpenSSL Security Advisory

#14

Post by marcosdumay » Thu, Jul 09, 2015, 1:20 PM UTC

runesoerensen wrote: post #7

It's worth noting that only releases since June 2015 are affected

That means, only releases that have no other known high severity bugs...

Re: OpenSSL Security Advisory

#15

Post by jgrahamc » Thu, Jul 09, 2015, 1:21 PM UTC

Interesting part is that the bug was introduced in the latest versions and has been fixed by the person who inserted it :-)

Bug added: https://github.com/openssl/openssl/commit/da084a5ec6cebd67ae...

Bug removed: https://github.com/openssl/openssl/commit/2aacec8f4a5ba1b365...

Although that's just the committer: https://twitter.com/agl__/status/619129579580469248

Re: OpenSSL Security Advisory

#16

Post by therealmarv » Thu, Jul 09, 2015, 1:21 PM UTC

0x0 wrote: post #8

Debian stable/oldstable is not affected. Only in unstable: https://security-tracker.debian.org/tracker/CVE-2015-1793

Well on Ubuntu I see nothing yet... http://www.ubuntu.com/usn/trusty/ I do not know if this is good or bad :(

Re: OpenSSL Security Advisory

#17

Post by marcosdumay » Thu, Jul 09, 2015, 1:22 PM UTC

eatonphil wrote: post #6

I've got a few sites using OpenSSL certs; do I need to do anything?

Unless you are using client side certificates, this one is not your problem.

But everybody must upgrade their browsers ASAP.

Re: OpenSSL Security Advisory

#18

Post by hackerhamza » Thu, Jul 09, 2015, 1:25 PM UTC

am a hacker looking for those who got old bank account in usa and canada td bank to load no upfront fee charge iload it we share it 5050 email me hamzaben.d@hackermail.com leave your phone number

Re: OpenSSL Security Advisory

#19

Post by mugsie » Thu, Jul 09, 2015, 1:25 PM UTC

therealmarv wrote: post #16

0x0 wrote: post #8

Debian stable/oldstable is not affected. Only in unstable: https://security-tracker.debian.org/tracker/CVE-2015-1793

Well on Ubuntu I see nothing yet... http://www.ubuntu.com/usn/trusty/ I do not know if this is good or bad :(

http://people.canonical.com/~ubuntu-security/cve/2015/CVE-20...

Re: OpenSSL Security Advisory

#20

Post by calpaterson » Thu, Jul 09, 2015, 1:25 PM UTC

marcosdumay wrote: post #17

eatonphil wrote: post #6

I've got a few sites using OpenSSL certs; do I need to do anything?

Unless you are using client side certificates, this one is not your problem. But everybody must upgrade their browsers ASAP.

Is that right? My reading of it is that this affects all cases where you verify the certificate