3 ms·

I gather that LibreSSL has an (unintended) OpenSSL dependency? "LibreSSL is composed of four parts: - The openssl(1) utility, which provides tools for managin

I gather that LibreSSL has an (unintended) OpenSSL dependency? "LibreSSL is composed of four parts: - The openssl(1) utility, which provides tools for managing keys, certificates, etc. - libcrypto: a library of cryptography fundamentals - libssl: a TLS library, backwards-compatible with OpenSSL - libtls: a new TLS library, designed to make it easier to write foolproof application" :shrug:

notaplumber 6y ago
No, LibreSSL is a fork of OpenSSL that predates this vulnerability, it even predates the OpenSSL 1.1.x API break (some compatibility has since been added), and has an entirely separate and new TLS 1.3 implementation. https://www.openbsd.org/papers/bsdcan2019-tls13.pdf https://www.openbsd.org/papers/bsdcan2019-tls13.pdf (video: https://www.youtube.com/watch?v=MCVIBwGOwNY https://www.youtube.com/watch?v=MCVIBwGOwNY) It maintains source compatibility with OpenSSL at an API and command-line level (e.g. openssl(1) utility). LibreSSL cannot copy code from later versions of OpenSSL as they relicensed it under the Apache 2.0 license.