3 ms·
> We sysadmins still remember debians effort to backport a fix to OpenSSL and breaking key generation. Could you remind those of us who don't remember that? Th
by yjftsjthsd-h 2y ago
> We sysadmins still remember debians effort to backport a fix to OpenSSL and breaking key generation.
Could you remind those of us who don't remember that? The big one I know about is CVE-2008-0166, but that was 1. not a backport, and 2. was run by upstream before they shipped it.
But yes, agreed that it's painful either way; I think it comes down to that someone has to do the legwork, and who exactly does it has trade-offs either way.
- lmm 2y agoIt wasn't run by upstream. It was run by the wrong mailing list, and only for one half of the Debian changes.
- Xylakant 2y agoYou’re correct. It wasn’t a backport, it was an attempt to fix a perceived issue that upstream had not fixed - a read of uninitialized memory. What the maintainer did not understand was that the call was deliberate. With this and subsequent changes, they broke the randomness in the key generation.
- LtWorf 2y agoGood thing openssl is so good it hasn't had any CVE at all in all the years since that happened right?
- Xylakant 2y agoSo we’re introducing new bugs to add a little extra spice? Not trying to defend the code quality of OpenSSL, but the fallout of this bug affected everything and everyone and bad keys are still found 16 years later as of 2024.[1] And it was completely and utterly unnecessary - reporting the issue to upstream and fixing it upstream would have prevented the entire disaster. [1]https://16years.secvuln.info/ https://16years.secvuln.info/
- LtWorf 2y agoYeah and now they know (like everyone else already knew) that uninitialised memory is a bad idea :D