3 ms·
Honest question: does LibreSSL have this same vulnerability? If they do, fair comment. If not, then they obviously changed something, ipso facto.
by brobdingnagians 6y ago
Honest question: does LibreSSL have this same vulnerability?
If they do, fair comment. If not, then they obviously changed something, ipso facto.
- hyperman1 6y agoGood question. I found this, release 17-03-2021, that seems to be the same bug. So yes, they had the same vulnerability. https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.2.5-relnotes.txt https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.2.5-... Update: AAAACHCHC!! Dates! Always the dates. OK, Very well. For your viewing pleasure: * Americans: Patch was released on 03-17-2021 * Europeans: Patch was released on 17-03-2021 * World inhabitants: Patch was released on 2021-03-17
- TimWolla 6y agoThis is the fix for the LibreSSL issue [1]: https://github.com/libressl-portable/openbsd/commit/5f00b800749f246861e892a17d9012bd25fc06ba https://github.com/libressl-portable/openbsd/commit/5f00b800... This is the fix for the OpenSSL issue: https://github.com/openssl/openssl/commit/02b1636fe3db274497304a3e95a4e32ced7e841b https://github.com/openssl/openssl/commit/02b1636fe3db274497... They don't appear to be related to me. One is a UAF, the other is a NULL pointer dereference. [1] The LibreSSL issue was found by HAProxy's continuous integration pipeline: https://github.com/haproxy/haproxy/issues/1115 https://github.com/haproxy/haproxy/issues/1115. Disclosure: I'm a community contributor of HAProxy, I help maintain the issue tracker and I took part in debugging the issue.