Sign in / up

back to article OpenSSL patch quashes rare HTTPS nasty, shores up crypto chops

OpenSSL maintainers have pushed a pair of patches, crushing a dangerous but uncommon bug that allows HTTPS to be unravelled while also hardening servers against downgrade attacks. Affected servers are open to key recovery attacks only if it runs certain Digital Signature Algorithm and static Diffie-Hellman key exchange …

COMMENTS

Post your comment
House rules Send corrections
Add to 'My topics' unstar *
  1. Bronek Kozicki

    admittedly

    ... this is not seem like silly coding bug, but weakness in the cryptography part. Which of course everyone assumed OpenSSL was doing right, despite other major flaws of the project ...

    1 1 Reply
  2. Dan 55 Silver badge

    I'll ask the question...

    Has this already been fixed in LibreSSL?

    0 0 Reply
    1. Dan 55 Silver badge
      Reply Icon

      Re: I'll ask the question...

      And I'll answer it... no it is not.

      https://en.wikipedia.org/wiki/LibreSSL#28_January_2016

      2 1 Reply
      1. Dan 55 Silver badge
        Reply Icon
        Facepalm

        Re: I'll ask the question...

        What I meant to say was LibreSSL was not affected, not that it has not been fixed.

        0 0 Reply
    2. Tomato42
      Reply Icon
      Stop

      Re: I'll ask the question...

      notepad.exe is also not vulnerable to the OpenSSL bugs, that doesn't make it particularly useful crypto library

      (LibreSSL guys aim to not support even a tenth of the features that OpenSSL supports - anything outside very simple web hosting is "out of scope" for them)

      0 1 Reply
      1. Dan 55 Silver badge
        Reply Icon

        Re: I'll ask the question...

        Odd because it is often used as a drop-in replacement.

        1 0 Reply
  3. Anonymous Coward
    Alert

    How would this work in the real world? That a heck of a thing to try to do, surely?

    0 1 Reply
  4. Binnacle
    WTF?

    Must be Joking

    OpenSSL should follow the example of CVEs and provide an "impact" rating to go with the "severity" rating. This one qualifies as severity HIGH, impact ZERO.

    Took 20 minutes to figure out how to invoke the vulnerable code:

    openssl genpkey -genparam -algorithm DSA -out dsap.pem -pkeyopt dsa_paramgen_bits:1024 -outform dh_rfc5114

    The number of folks who have employed this are counted on one hand.

    0 0 Reply
  5. druck Silver badge
    Joke

    Adobe spots bug

    Antonio's work on this is very much appreciated, but can we assume from this that Adobe have fixed all their own bugs, and now have time to scrutinise open source projects?

    1 0 Reply
    1. allthecoolshortnamesweretaken
      Reply Icon

      Re: Adobe spots bug

      Unlikely. This is probably more along the lines of "it takes one to know one"

      0 0 Reply
  6. JamesSmith1
    Trollface

    "The high severity bug (CVE-2016-0701) revealed by Adobe engineer Antonio Sanso"

    Why is an Adobe engineer working on this? Surely they should be hard at work patching Flash.

    1 0 Reply

POST COMMENT House rules

Not a member of The Register? Create a new account here.

Forgotten password ?

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like