3 ms·
FTA: > OpenSSL 3.0.0 SSL/TLS clients are affected by this issue. > OpenSSL 1.1.1 and 1.0.2 are not affected by this issue. I haven't encountered any stable di
by throitallaway 5y ago
FTA:
> OpenSSL 3.0.0 SSL/TLS clients are affected by this issue.
> OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.
I haven't encountered any stable distro running a higher version than 1.1.1. Arch, Debian Unstable, Alpine latest, and Ubuntu 20.10 are all on 1.1.1.
- CameronNemo 5y agoStill does not inspire confidence. This is the second CVE this year, after they pushed out a vulnerable TLS 1.3 version.
- hannob 5y agoIt's actually the 8th: https://www.openssl.org/news/vulnerabilities.html https://www.openssl.org/news/vulnerabilities.html But this really isn't that unusual for a library of that complexity and size. All of these vulns are pretty boring, none is likely to cause any bigger harm.
- CameronNemo 5y agoHmm also the TLS 1.3 bug was in April 2020... Uh oh I am on covid time.