OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f • Hacker News Board

OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

#1

Post by AngeloR » Tue, Apr 21, 2020, 2:28 PM UTC

OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f
openssl.org

Re: OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

#2

Post by 9wzYQbTYsAIc » Tue, Apr 21, 2020, 4:41 PM UTC

> This issue was found by Bernd Edlinger and reported to OpenSSL on 7th April 2020. It was found using the new static analysis pass being implemented in GCC, -fanalyzer.

2 week turnaround time, not bad I guess, for something found by a static analyzer.

Re: OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

#3

Post by nayuki » Tue, Apr 21, 2020, 5:28 PM UTC

What popular software contain these vulnerable versions of the OpenSSL library?

Re: OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

#4

Post by erichdongubler » Tue, Apr 21, 2020, 5:43 PM UTC

nayuki wrote: post #3

What popular software contain these vulnerable versions of the OpenSSL library?

This is a good question. Also important to remember is that for many Linux distributions dynamically linked OpenSSL artifacts are what end up getting used by the vast majority of binaries.

Re: OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

#5

Post by AngeloR » Tue, Apr 21, 2020, 5:51 PM UTC

nayuki wrote: post #3

What popular software contain these vulnerable versions of the OpenSSL library?

I have no idea what a full list looks like.. but the nginx:1.17.10-alpine docker image contains the following:

    / # nginx -V                              
    nginx version: nginx/1.17.10
    built by gcc 9.2.0 (Alpine 9.2.0)
    built with OpenSSL 1.1.1d  10 Sep 2019

Re: OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

#6

Post by judge2020 » Tue, Apr 21, 2020, 5:55 PM UTC

At least it's just DOS and not anything like heartbleed.

Re: OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

#7

Post by stuff4ben » Tue, Apr 21, 2020, 6:13 PM UTC

This would primarily affect web servers exposing SSH access to the public right? I suppose it also affects internally accessible servers as well but to a lesser degree in terms of priority.

Re: OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

#8

Post by detaro » Tue, Apr 21, 2020, 6:15 PM UTC

stuff4ben wrote: post #7

This would primarily affect web servers exposing SSH access to the public right? I suppose it also affects internally accessible servers as well but to a lesser degree in terms of priority.

SSH != SSL. EDIT: Expect web servers running HTTPS in modern configurations to be affected, and other TLS based protocols. SSH is fine.

Re: OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

#9

Post by pronoiac » Tue, Apr 21, 2020, 6:24 PM UTC

Checking out packages.ubuntu.com, it looks like the only version impacted is "focal;" the other versions are too old.

Re: OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

#10

Post by chupa-chups » Tue, Apr 21, 2020, 6:25 PM UTC

detaro wrote: post #8

stuff4ben wrote: post #7

This would primarily affect web servers exposing SSH access to the public right? I suppose it also affects internally accessible servers as well but to a lesser degree in terms of priority.

SSH != SSL. EDIT: Expect web servers running HTTPS in modern configurations to be affected, and other TLS based protocols. SSH is fine.

Both SSH and SSL base on TLS. The leak in question has a problem

> during or after a TLS 1.3 handshake

Sure, openSSL is not SSH, but it is not unreasonable to assume this leak may affect web servers as well (e.g. by being based on the same underlying TLS implementation).

"SSH != SSL" is a bit short to invalidate the assumption of the OP. I'd not be so sure this problem does not affect "web server X".

https://en.wikipedia.org/wiki/Transport_Layer_Security

OK, learnt something new today: https://crypto.stackexchange.com/questions/60255/why-doesnt-...

https://xkcd.com/1053/

Thanks! :)