Admins! Never mind POODLE, there're NEW OpenSSL bugs to splat

Re: I wonder

It would require a tremendous stretch to believe any of these were plants. One (support for TLS_FALLBACK_SCSV) is in fact a new feature; it isn't a "fix" by any definition. Of the other three, two are DoS issues, which are of very low value to the SIGINT community.

The last could have some SIGINT utility, since getting a product to downgrade to SSLv3 leaves it open to decryption attacks like POODLE and BEAST (when using a block cipher) or RC4 bias exploitation. But few OpenSSL installations use a version built with --no-ssl3, so on the whole it'd be a very low-value attack. If a SIGINT agency had an opportunity to sneak a flaw into the OpenSSL sources, they could do much better.

Re: Debian Security Announcement

Let's be honest. If you don't know what the advisory means then you aren't the intended audience.

Re: Debian Security Announcement

Is it absolutely impossible for these guys to just send out an announcement in plain English?

A memory leak flaw was found in the way an OpenSSL handled failed

session ticket integrity checks. A remote attacker could exhaust all

available memory of an SSL/TLS or DTLS server by sending a large number

of invalid session tickets to that server.

What? Where, what typical applications/scenarios might be affected? Real world examples? No wonder the Open Source world has such a bad rep amongst non geeks. Pure gobbledygook brought on by severe laziness and extreme arrogance.

That's pretty plain english for an announcement on crypto library.They clearly state the issue is in session handling and that can be used to exhaust memory. Don't really see how it could be any clearer.

There are so many applications using OpenSSL that listing them would not be practical. I doubt OpenSSL team even know all the applications that may use the libraries.

The announcement is obviously intended to somewhat technical audience. It would be up to your sysadmin (in corporate environment) to disseminate information as to what, within your organisation, is affected and how.

Would you think of the same of a technical bulletin issued by car manufacturer, when it is really intended for mechanics rather than end users?

I'm sorry but it appears the laziness and arrogance is on your part for assuming the technical announcement from developers would be watered down to be suitable for you.