101–110 of 142 posts
The latest version (2.3.7) of the official OpenVPN client is vulnerable, as is Tunnelblick for OSX. No fix has been published yet. The OpenVPN clients for Android and iOS are not affected. See https://mullvad.net/en/v2/news for more details.
Earlier quoted context omitted.
Christ, what a mess of a project. They inserted this after their big promise to do better after heartbleed? No wonder distros take their time moving to a new version. I really hope one of the alternative SSL libraries get picked up by the major distros. This is embarrassing, especially for those of us who have to justify FOSS in our environment. LibreSSL looks promising. Hopefully competition will mean better outcome…
"Patch provided by the BoringSSL project." This is an example of them doing better. A bug was found, reported to them, and they responded quickly giving advanced notice too.
Interesting part is that the bug was introduced in the latest versions and has been fixed by the person who inserted it :-) Bug added: https://github.com/openssl/openssl/commit/da084a5ec6cebd67ae... Bug removed: https://github.com/openssl/openssl/commit/2aacec8f4a5ba1b365... Although that's just the committer: https://twitter.com/agl__/status/619129579580469248
Looking at the changes that introduced the bug, it's obvious that the nature of the problems being solved is too complex for the changes to be only "visually" reviewed. There must be enough external tests to "uncover" the potential issues. And the tests of course can have the bugs too, not covering what needed to be covered. That's why for so sensitive code the testers should be the best programmers with additional p…
Earlier quoted context omitted.
BTW there's a reason for that. The IETF decided (it must be a couple of decades ago) to restrict itself to matters of the internet. Things like file formats are thus out of scope for RFCs. There have been exceptions, RFC5952 is a good example and I know at least two others, but by and large RFCs are about the internet now, not about file formats or other worthy subjects.
RFC 6120 and 6121 are for XMPP (chat), and define XML is to be used, and even goes into the exact structure of the XML "packets".
from test/verify_extra_test.c: Test for CVE-2015-1793 (Alternate Chains Certificate Forgery) Chain is as follows: rootCA (self-signed) | interCA | subinterCA subinterCA (self-signed) | | leaf ------------------ | bad rootCA, interCA, subinterCA, subinterCA (ss) all have CA=TRUE leaf and bad have CA=FALSE subinterCA and subinterCA (ss) have the same subject name and keys interCA (but not rootCA) and subinterCA (ss) ar…
openssl would accept certs that have been issued by a non-ca cert (which is trusted).
So if you have control over the leaf cert, you can just use it for contacting openssl.
If you don't have control over the leaf cert, you can't issue a bad cert.
Am I missing something?
Earlier quoted context omitted.
You seriously have trouble reading "i", "j", "param" and "num"? Hell, "ok", "depth" and "retry" are already in your English-language dictionary! I'll grant that having variables named with "tmp" is confusing out of context, I guess. But if you're trying to start a Java-style war over this stuff, just recognize that most of the world has moved on and views names like those as perfectly fine when used within standard i…
Are you kidding me? There is no possible universe in which 'param' is an acceptable name for an argument.
class Function {
public apply(T param);
}The latest version (2.3.7) of the official OpenVPN client is vulnerable, as is Tunnelblick for OSX. No fix has been published yet. The OpenVPN clients for Android and iOS are not affected. See https://mullvad.net/en/v2/news for more details.
Earlier quoted context omitted.
Looking at the changes that introduced the bug, it's obvious that the nature of the problems being solved is too complex for the changes to be only "visually" reviewed. There must be enough external tests to "uncover" the potential issues. And the tests of course can have the bugs too, not covering what needed to be covered. That's why for so sensitive code the testers should be the best programmers with additional p…
You're confused. This thread is about OpenSSL. OpenSSL doesn't have tests.
AWS response: http://aws.amazon.com/security/security-bulletins/openssl-se...
I was considering using the `ec2.py` script from Vagrant's dynamic inventory docs and then running SSH command execution over all our instances to upgrade the packages for both Ubuntu and AWS AMIs (yum), just to be safe. Guess I don't need to after all!