3 ms·
Why would their update need to address more than just (1)? That's the only part of the problem that they have to deal with. The OpenSSL team should be the one a
by mynameisvlad 13y ago
Why would their update need to address more than just (1)? That's the only part of the problem that they have to deal with. The OpenSSL team should be the one answering (2) and (3), since it's OpenSSL that copies the PK/parts after it's been read, or allocate temp vars for intermediates. If Akamai chooses to patch those two problems and then releases it to open source like their initial patch, then they can answer them, but otherwise, what's the point?
- Danieru 13y ago(2) & (3) are not bugs for OpenSSL because only Akamai is trying to segregate the key data. In upstream OpenSSL the intermediates are stored in the same memory pool as the key data. Thus the intermediates do not expose privileged data anywhere it is not already present. Without addressing issues 2 & 3 Akamai's patch is not a line of defense. It does not guard against dirty memory exploits like Heartbleed, it only increases the difficulty of exploitation.