3 ms·
What I really want to know is does this affect LibreSSL? That would be an interesting comparison.
by monstermonster 12y ago
What I really want to know is does this affect LibreSSL?
That would be an interesting comparison.
- stonogo 12y agoIt was reported by LibreSSL.
- laumars 12y agoI assume you're referring to the memory leaks (CVE-2014-3513 & CVE-2014-3567)? (as there's a few items being patched). My guess is that it doesn't since OpenSSL use a bespoke memory allocator / deallocator which, if I recall correctly, was one of the things that Theo de Raadt was criticising OpenSSL over. The TLS_FALLBACK_SCSV patch (re POODLE) was ported from BoringSSL (Google's fork of OpenSSL) to address TLS 1.0 downgrading to SSL 3.0. From what I understand, and I might be wrong on this, this is a protocol issue rather than a bug with specific SSL libraries. So LibreSSL might also see a similar TLS_FALLBACK_SCSV patch applied.
- Kalium 12y agoPOODLE is a protocol design issue, yes. In short, the padding is not covered by the MAC.
- zymhan 12y agoDid you read the post? They specifically state that it was discovered and patched by LibreSSL.
- monstermonster 12y agoYes and I actually missed that bit. I hang my head in shame :(