3 ms·

OpenSSL Security Policy

• protomyth 7y ago
  Threat Model Certain threats are currently considered outside of the scope of the OpenSSL threat model. Accordingly, we do not consider OpenSSL secure against the following classes of attacks: same physical system side channel CPU/hardware flaws physical fault injection physical observation side channels (e.g. power consumption, EM emissions, etc) Mitigations for security issues outside of our threat scope may still be addressed, however we do not class these as OpenSSL vulnerabilities and will therefore not issue CVEs for any mitigations to address these issues. We are working towards making the same physical system side channel attacks very hard.* Prior to the threat model being included in this policy, CVEs were sometimes issued for these classes of attacks. The existence of a previous CVE does not override this policy going forward.