5 ms·
The bug has "only" been present for 3 years. I think no enterprise appliance new enough to ship with an affected OpenSSL version is old enough to be EoL.
by sspiff 13y ago
The bug has "only" been present for 3 years. I think no enterprise appliance new enough to ship with an affected OpenSSL version is old enough to be EoL.
- jlgaddis 13y agoYou're probably right, but what about pre-existing kit that received an update that included the b0rked version of SSL and went EoL since? I haven't kept up on what version of FreeBSD is being used as the basis of JunOS nowadays but I would not be surprised to hear of EoL Juniper kit that included the flawed code. (I have no evidence that JunOS includes OpenSSL code but I assume that it does.)
- peterwwillis 13y agoIt's not just EoL that has to be replaced. If you don't have a support contract and can't afford/don't want to renew, and the patch is under support only, you have to replace your gear because you can't get the patch.
- mkonecny 13y agoIt's been present for 2 years.