3 ms·
You’re correct. It wasn’t a backport, it was an attempt to fix a perceived issue that upstream had not fixed - a read of uninitialized memory. What the maintain
by Xylakant 2y ago
You’re correct. It wasn’t a backport, it was an attempt to fix a perceived issue that upstream had not fixed - a read of uninitialized memory. What the maintainer did not understand was that the call was deliberate. With this and subsequent changes, they broke the randomness in the key generation.
- LtWorf 2y agoGood thing openssl is so good it hasn't had any CVE at all in all the years since that happened right?
- Xylakant 2y agoSo we’re introducing new bugs to add a little extra spice? Not trying to defend the code quality of OpenSSL, but the fallout of this bug affected everything and everyone and bad keys are still found 16 years later as of 2024.[1] And it was completely and utterly unnecessary - reporting the issue to upstream and fixing it upstream would have prevented the entire disaster. [1]https://16years.secvuln.info/ https://16years.secvuln.info/
- LtWorf 2y agoYeah and now they know (like everyone else already knew) that uninitialised memory is a bad idea :D