21–30 of 47 posts
OpenSSL is the culprit of a MacPort installation issue (vde2) for which there is no maintainer. It exposes operational vulnerability to unmaintained open source software.
OpenSSL is the culprit of a MacPort installation issue (vde2) for which there is no maintainer. It exposes operational vulnerability to unmaintained open source software.
If you want to use unmaintained software, you know OpenSSL 1.0 still exists in this world, right?
Checking out packages.ubuntu.com, it looks like the only version impacted is "focal;" the other versions are too old.
Earlier quoted context omitted.
SSH != SSL. EDIT: Expect web servers running HTTPS in modern configurations to be affected, and other TLS based protocols. SSH is fine.
Both SSH and SSL base on TLS. The leak in question has a problem > during or after a TLS 1.3 handshake Sure, openSSL is not SSH, but it is not unreasonable to assume this leak may affect web servers as well (e.g. by being based on the same underlying TLS implementation). "SSH != SSL" is a bit short to invalidate the assumption of the OP. I'd not be so sure this problem does not affect "web server X". https://en.wikip…
You are very mistaken. OpenSSH only uses OpenSSL (or LibreSSL) as an optional dependency for the libcrypto primitives (RSA/AES etc). NOT for libssl.
The SSH protocol has nothing to do with either SSL or TLS.
Checking out packages.ubuntu.com, it looks like the only version impacted is "focal;" the other versions are too old.
Is there a reason why something as important as openssl is not being backported to keep up with the most recent versions?
Ubuntu backports the fixes them instead (i.e. Ubuntu's 1.0.2 will be patch with CVE fixes going forward instead of backporting 1.1 wholesale).
What popular software contain these vulnerable versions of the OpenSSL library?
What popular software contain these vulnerable versions of the OpenSSL library?
I have no idea what a full list looks like.. but the nginx:1.17.10-alpine docker image contains the following: / # nginx -V nginx version: nginx/1.17.10 built by gcc 9.2.0 (Alpine 9.2.0) built with OpenSSL 1.1.1d 10 Sep 2019
built with OpenSSL 1.1.1d 10 Sep 2019 (running with OpenSSL 1.1.1g 21 Apr 2020)OpenSSL vulnerabilities: The gift that keeps on giving.
I'm hoping it will eventually reach status of bind or sendmail, they had also very bad track record, but vulnerabilities now are quite rare.
Sure, let's continue to reward incompetence by further funding openssl. In a sane world, everybody would have switched to libressl ages ago.
Void is considering switching back too: https://github.com/void-linux/void-packages/issues/20935