6 ms·

OpenSSL security advisory 2016-03-01

139 points by kpcyrd 11y ago

Mojah 11y ago
Mirrored here, in case the official source goes down: https://marc.ttias.be/openssl-announce/2016-03/msg00002.php https://marc.ttias.be/openssl-announce/2016-03/msg00002.php
jlgaddis 11y ago
Permanent link to the original advisory (not the mailing list announcement), which "may be updated with additional details over time": https://www.openssl.org/news/secadv/20160301.txt https://www.openssl.org/news/secadv/20160301.txt
ck2 11y ago
CentOS "no packages marked for update" hmm, still at openssl-1.0.1e-51.el7_2.2.x86_64
- darkr 11y ago
  I just got a notification that new builds for CentOS 6 and 7 were being pushed out to the mirrors now..
  - ck2 11y ago
    ah finally ---> Package openssl.x86_64 1:1.0.1e-51.el7_2.2 will be updated ---> Package openssl.x86_64 1:1.0.1e-51.el7_2.4 will be an update ---> Package openssl-devel.x86_64 1:1.0.1e-51.el7_2.2 will be updated ---> Package openssl-devel.x86_64 1:1.0.1e-51.el7_2.4 will be an update ---> Package openssl-libs.x86_64 1:1.0.1e-51.el7_2.2 will be updated ---> Package openssl-libs.x86_64 1:1.0.1e-51.el7_2.4 will be an update
antx 11y ago
Mostly fixed in debian... damn these guys are fast! https://security-tracker.debian.org/tracker/source-package/openssl https://security-tracker.debian.org/tracker/source-package/o...
geggam 11y ago
Bob Beck ‏@bob_beck So of 8 #openssl things forthcoming, all but two low severity ones were already fixed in #libressl - You won't need to patch #libressl today https://twitter.com/bob_beck/status/704693297583788032 https://twitter.com/bob_beck/status/704693297583788032
- asddubs 11y ago
  I'm still a little bitter http://opensslrampage.org/ http://opensslrampage.org/ stopped updating, it was always good for a chuckle
yuhong 11y ago
There used to be an OpenSSL worm that took advantage of a bug in the SSLv2 support: http://tech.slashdot.org/story/02/09/25/1210247/new-linux-worm-found-in-the-wild http://tech.slashdot.org/story/02/09/25/1210247/new-linux-wo...
ultramancool 11y ago
This is in Ubuntu LTS as 1.0.1f-1ubuntu2.18 http://changelogs.ubuntu.com/changelogs/pool/main/o/openssl/openssl_1.0.1f-1ubuntu2.18/changelog http://changelogs.ubuntu.com/changelogs/pool/main/o/openssl/... Deployed it in all of 2 minutes this morning. Ansible rocks.
walrus01 11y ago
I am enjoying an environment configured to only allow TLSv1.2 and deny everything else. It may not be a realistic option for everyone, but for anything new built in 2015 and later is the only sensible choice.

139 points by kpcyrd 11y ago

Mojah 11y ago

Mirrored here, in case the official source goes down: https://marc.ttias.be/openssl-announce/2016-03/msg00002.php https://marc.ttias.be/openssl-announce/2016-03/msg00002.php

jlgaddis 11y ago

Permanent link to the original advisory (not the mailing list announcement), which "may be updated with additional details over time": https://www.openssl.org/news/secadv/20160301.txt https://www.openssl.org/news/secadv/20160301.txt

ck2 11y ago

CentOS "no packages marked for update" hmm, still at openssl-1.0.1e-51.el7_2.2.x86_64

darkr 11y ago
I just got a notification that new builds for CentOS 6 and 7 were being pushed out to the mirrors now..
- ck2 11y ago
  ah finally ---> Package openssl.x86_64 1:1.0.1e-51.el7_2.2 will be updated ---> Package openssl.x86_64 1:1.0.1e-51.el7_2.4 will be an update ---> Package openssl-devel.x86_64 1:1.0.1e-51.el7_2.2 will be updated ---> Package openssl-devel.x86_64 1:1.0.1e-51.el7_2.4 will be an update ---> Package openssl-libs.x86_64 1:1.0.1e-51.el7_2.2 will be updated ---> Package openssl-libs.x86_64 1:1.0.1e-51.el7_2.4 will be an update

antx 11y ago

Mostly fixed in debian... damn these guys are fast! https://security-tracker.debian.org/tracker/source-package/openssl https://security-tracker.debian.org/tracker/source-package/o...

geggam 11y ago

Bob Beck ‏@bob_beck So of 8 #openssl things forthcoming, all but two low severity ones were already fixed in #libressl - You won't need to patch #libressl today https://twitter.com/bob_beck/status/704693297583788032 https://twitter.com/bob_beck/status/704693297583788032

asddubs 11y ago
I'm still a little bitter http://opensslrampage.org/ http://opensslrampage.org/ stopped updating, it was always good for a chuckle

yuhong 11y ago

There used to be an OpenSSL worm that took advantage of a bug in the SSLv2 support: http://tech.slashdot.org/story/02/09/25/1210247/new-linux-worm-found-in-the-wild http://tech.slashdot.org/story/02/09/25/1210247/new-linux-wo...

ultramancool 11y ago

This is in Ubuntu LTS as 1.0.1f-1ubuntu2.18 http://changelogs.ubuntu.com/changelogs/pool/main/o/openssl/openssl_1.0.1f-1ubuntu2.18/changelog http://changelogs.ubuntu.com/changelogs/pool/main/o/openssl/... Deployed it in all of 2 minutes this morning. Ansible rocks.

walrus01 11y ago

I am enjoying an environment configured to only allow TLSv1.2 and deny everything else. It may not be a realistic option for everyone, but for anything new built in 2015 and later is the only sensible choice.