OpenSSL Patches Eight New Vulnerabilities 79
itwbennett writes: Server administrators are advised to upgrade OpenSSL again to fix eight new vulnerabilities, two of which can lead to denial-of-service (DoS) attacks. Although the flaws are only of moderate and low severity, "system administrators should plan to upgrade their running OpenSSL server instances in the coming days," said Tod Beardsley, engineering manager at vulnerability intelligence firm Rapid7.
Sick of this (Score:3, Insightful)
LibreSSL can't come soon enough.
Re: (Score:1)
A library with bugs in it? An open source project is getting fixed as more people look at it? The hell you say.... Next you will be telling me they fix bugs in the kernel.... weeeeeeeeeeird....
Re: (Score:1)
Five of those vulnerabilites are two and a half months old. I don't care how "low" the severity is, it should not take that long to be patched.
Re:Sick of this (Score:5, Informative)
Of course it did, it is a fork (copy) of OpenSSL.
However, one or two of the issues were fixed in LibreSSL back in May, before being discovered in OpenSSL.
They were fixed as part of the general code quality improvement, and cleaning up the error handling and memory management.
https://twitter.com/bob_beck/status/553233391164743682
Re:Time to switch to LibreSSL (Score:5, Informative)
If you had been paying attention you'd know that OpenSSL gets bugs reported, LibreSSL fixes them while OpenSSL stands around with their collective dick in their hands.
Re: (Score:1)
Agree..
I'm all for security fixes.. but seriously, when are they going to look for some serious flaws and fix those, rather than pretend they're doing above and beyond by "fixing tens of vulnerabilities!!!" that are merely low severity ?
I really hope LibreSSL [libressl.org] takes over some day, including the corporate market, with FIPS and other compliance too.
Re: (Score:1)
Re: (Score:2, Informative)
Because all commits have to be approved by the top team; Who, again, stand around with their dicks in their hands. Doesn't matter how fast you are to help them, but until one approves it, it isn't fixed.
Re: (Score:1)
What? (Score:2)
OpenSSL had crippling bugs for years until heartbleed. Tens of thousands of people spoke of the virtue of open source and "many eyes" but apparently the author was the only one reading the source.
Re: (Score:2)
Re: (Score:2)
That level of programmer isn't all that common, especially for software as complicated as most security software is.
You don't have to be a genius to spot bugs in openSSL. Even a non-professional programmer could look at it and say, "Yeah, that stuff is bad."
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Because I'm too busy "reading the source" and fixing shit in a bunch of other projects. One person can only do so much.
Go easy on the OpenSSL guys ! (Score:5, Interesting)
With a closed source product you basically have to trust the vendor to get it right, and to patch defects in a timely manner.
OpenSSL is a classic demonstration of one of the truths of computer programming - namely that good cryptography is HARD.
I just wish that the big players who use this in their products would support the developers - and make it a better outcome for all of us who rely on this product.
Re: (Score:3)
#2: write readable and maintainable code.
Re: (Score:2)
I think this is a good sign for a differerent reason.
We all know OpenSSL could be a lot better. Supposedly they got more funding.
If they are busy finding and fixing bugs that's could be a good thing.
Re: (Score:1, Insightful)
OpenSSL is a classic demonstration of one of the truths of computer programming - namely that good cryptography is HARD.
Or possibly that people who are good at cryptography aren't necessarily very good at programming.
Many of the bugs has nothing to do with cryptography but are the result of bad programming practices in general.
Re: (Score:3)
OpenSSL is a classic demonstration of one of the truths of computer programming - namely that good cryptography is HARD.
OpenSSL is a mess that demonstrates nothing of the sort. Cryptography is hard but openSSL lost before getting to that point by having horrid coding practices.
If you want to have a clear understanding of how bad it is, the OpenBSD team is live blogging the mess as they clean it up. [opensslrampage.org] In short, OpenSSL was not written by a responsible (or entirely competent) dev team.
Re: (Score:2)
uses html4-ish concepts from the 90's
The internet was a better place then, man.
Re: (Score:2)
Show us the code!
You must have missed the link.
Re:OpenSSL must fucking die (Score:5, Insightful)
Correction (Score:2)
OpenSSL patches eight old vulnerabilities
FTFY. They are newly discovered, but not new.
Fork OpenSSL to OpenTLS (Score:2)
I feel it would make most sense if they plan for the abolishing of OpenSSL in favor of a new library called OpenTLS.
Fork OpenSSL to OpenTLS but only take those technologies that are currently known to be good/safe and still have some future. For instance, don’t copy SSL or TLS 1.0 to the new fork. Nobody should be using SSL anyway so it can easily stay out of the new OpenTLS.
The new OpenTLS library can then be cleaned up and strenghtened without causing too much harm to users of legacy OpenSSL, althou
Re: (Score:1)
I think the LibreSSL people have shown that any such project should probably be restarted from scratch.
Overall, my experience with dealing with various libraries is that what someone really needs is to write a library that basically wraps connect() accept() write() read() and close() so that people can just do SSL without needing a billion steps that are poorly documented and trivial to completely fuck up.
While I'm begging, I'd also like someone to make a modern SSL cert tool that handles all the fancy shit
Re:Fork OpenSSL to OpenTLS (Score:4, Insightful)
Fork OpenSSL to OpenTLS but only take those technologies that are currently known to be good/safe and still have some future.
It's a fine idea but it wouldn't help you because the problem isn't the algorithm, the problem is the code. OpenSSL is known to have bugs in its TLS code, too. The problems here start even before getting to the algorithm.
Re:Fork OpenSSL to OpenTLS (Score:4, Informative)
Been tried already; see gnutls [gnutls.org]. We tried to switch from OpenSSL to gnutls as the preferred SSL library for PostgreSQL a few years back, even got some press coverage [lwn.net] documenting the whole thing. But, sadly, OpenSSL has too many quirky APIs to make a transition away from it easy. And anyone who tries to be "bug compatible" creating a replacement to that mess is going to inherit some of the same bad design that needs to be burned with fire.
Re: (Score:2)
Uhm, it's already been done: libressl