Comments on: OpenSSL update

By: dh

dh — Tue, 10 Jun 2014 21:29:02 +0000

OpenBSD was apparently not formally notified because it was not on some list. One OpenBSD lead developer also wrote that he didn’t wish to be added to that list for time constraints: http://marc.info/?l=oss-security&m=139906348230995

By: Franco Fichtner

Franco Fichtner — Tue, 10 Jun 2014 11:36:28 +0000

Here’s the patch for reference: https://bitbucket.org/braindamaged/openbsd-src/commits/9a2a133d99

By: Franco Fichtner

Franco Fichtner — Tue, 10 Jun 2014 11:34:27 +0000

There’s always the option of backporting the actual vulnerability fixes (usually only a couple of lines). It’s unclear how secure and trustworthy the library really is at this point, but that’s a decision maintainers/projects needs to make for its users.

BTW, LibReSSL was also affected, and of course older versions of OpenBSD still run with normal OpenSSL, so these are affected too.

By: Edward M

Edward M — Tue, 10 Jun 2014 05:39:16 +0000

I find it odd why OpenBSD was not notified, people uses it in production systems.
I hope dragonfly will switch to libressl, when it is ready..

By: Justin Sherrill

Justin Sherrill — Tue, 10 Jun 2014 03:49:06 +0000

I am not sure – I have been watching the OpenBSD commits, but I haven’t seen it… but then again, unless the commit message started with a big “this is for this problem” note, I may have skated right by it.

By: Anonymous

Anonymous — Tue, 10 Jun 2014 03:44:28 +0000

My question about libressl, is it affected by these same issues that were pointed out this week?

By: Justin Sherrill

Justin Sherrill — Tue, 10 Jun 2014 03:37:05 +0000

What’s the alternative if you’ve already got a version with known issues?

By: Franco Fichtner

Franco Fichtner — Mon, 09 Jun 2014 22:11:42 +0000

I’d heavily discourage anyone from updating to newer OpenSSL versions as new features may be potential new issues. Exploitable code seems to pop up with an alarming rate in releases.