5 ms·

Jessie has 5 changesets on top of 1.0.1k which fix 14 CVE's: http://anonscm.debian.org/viewvc/pkg-openssl/openssl/branches/jessie/debian/changelog?revision=756

by xuhu 11y ago

Jessie has 5 changesets on top of 1.0.1k which fix 14 CVE's: http://anonscm.debian.org/viewvc/pkg-openssl/openssl/branches/jessie/debian/changelog?revision=756&view=markup http://anonscm.debian.org/viewvc/pkg-openssl/openssl/branche... And similar for the other debian versions.

PythonicAlpha 11y ago
Ok, is there any CVE that covers this attack / disables SSLv2? This is rather in-transparent to me. Would be nice, if somebody could give better advice on this soon.
- xuhu 11y ago
  DROWN is CVE-2016-0800. There are a lot of CVE's in openssl's advisory released 10 minutes ago: https://www.openssl.org/news/secadv/20160301.txt https://www.openssl.org/news/secadv/20160301.txt None are fixed yet of course in debian. And not in ubuntu either: http://changelogs.ubuntu.com/changelogs/pool/main/o/openssl/openssl_1.0.2d-0ubuntu1.3/changelog http://changelogs.ubuntu.com/changelogs/pool/main/o/openssl/...
  - rlpb 11y ago
    Actually Ubuntu is not affected because it already has SSLv2 disabled: http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-0800.html http://people.canonical.com/~ubuntu-security/cve/2016/CVE-20... You won't see a fix appear in the changelog because there is nothing to fix in the Ubuntu packages.