3 ms·
Note that HIGH severity isn't the highest severity (that's CRITICAL) [1]. The last high severity fix in OpenSSL was this past December. [1] https://www.openss
by jonas21 6y ago
Note that HIGH severity isn't the highest severity (that's CRITICAL) [1].
The last high severity fix in OpenSSL was this past December.
[1] https://www.openssl.org/policies/secpolicy.html https://www.openssl.org/policies/secpolicy.html
- hosteur 6y agoWhat was the severity of heart bleed?
- richardwhiuk 6y agohttps://www.openssl.org/news/secadv/20140407.txt https://www.openssl.org/news/secadv/20140407.txt is the advisory, but this was back when OpenSSL wasn't as well maintained. It would have been CRITICAL.
- leonardinius 6y agoIt was CRITICAL and warranted new severity level added [1] [1] - https://www.openssl.org/blog/blog/2015/09/28/critical-security-level/ https://www.openssl.org/blog/blog/2015/09/28/critical-securi...
- deleted 6y ago[deleted]
- 0x003 6y ago> HIGH Severity. This includes issues that are of a lower risk than critical, perhaps due to affecting less common configurations, or which are less likely to be exploitable. These issues will be kept private and will trigger a new release of all supported versions. We will attempt to keep the time these issues are private to a minimum; our aim would be no longer than a month where this is something under our control So something to make sure you update, but not a Heartbleed level concern