3 ms·
Logos are now prerequisite, so of course CVE-2014-0224 has you covered. http://ccsinjection.lepidum.co.jp http://ccsinjection.lepidum.co.jp If you want to see
by reaperhulk 12y ago
Logos are now prerequisite, so of course CVE-2014-0224 has you covered. http://ccsinjection.lepidum.co.jp http://ccsinjection.lepidum.co.jp
If you want to see the patches they're now up on GitHub:
OpenSSL 1.0.1: https://github.com/openssl/openssl/commits/OpenSSL_1_0_1-stable https://github.com/openssl/openssl/commits/OpenSSL_1_0_1-sta...
OpenSSL 1.0.0: https://github.com/openssl/openssl/commits/OpenSSL_1_0_0-stable https://github.com/openssl/openssl/commits/OpenSSL_1_0_0-sta...
OpenSSL 0.9.8: https://github.com/openssl/openssl/commits/OpenSSL_0_9_8-stable https://github.com/openssl/openssl/commits/OpenSSL_0_9_8-sta...
- kerneis 12y ago"Q. How did you find this bug? A. This bug was discovered by Masashi Kikuchi of Lepidum. He found this bug while studying safe TLS implementations using a proof assistant system Coq." So they are starting to find actual bugs with Coq? I'm impressed, and would love to know if anybody has more details (lepidum's blog seems down at the moment).
- johnkeeping 12y agoThe ImperialViolet post linked above gives a different URL for the blog post which does work: http://ccsinjection.lepidum.co.jp/blog/2014-06-05/CCS-Injection-en/index.html http://ccsinjection.lepidum.co.jp/blog/2014-06-05/CCS-Inject...
- bashinator 12y agoThere's some good discussion of it on the netsec subreddit. http://www.reddit.com/r/netsec/comments/27dhcn/openssl_security_advisory_seven_security_fixes/chzv3j6?context=2 http://www.reddit.com/r/netsec/comments/27dhcn/openssl_secur...
- deleted 12y ago[deleted]