3 ms·

Good luck in updating it in OS X (try running `ssh -V` there). Good that OS X will update to a more recent version in El Capitan and also switch to LibreSSL (gr

Good luck in updating it in OS X (try running `ssh -V` there). Good that OS X will update to a more recent version in El Capitan and also switch to LibreSSL (great step forward).

nifoc 11y ago
SSH under OS X uses OSSLShim, which is wrapper around Secure Transport. I'm not exactly sure when they started using it for this, but it has been a while. If you're seeing OpenSSL in the output, you have probably installed SSH via Homebrew.
- 9700094 11y ago
  These are the versions on 10.10.3: OpenSSL 0.9.8zd 8 Jan 2015 OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
- therealmarv 11y ago
  ah ok thanks. Actually I do not see OpenSSL there. I've looked too fast and thought OpenSSL is still used in OS X.
- sslalready 11y ago
  Usage of openssl has been deprecated since OS X 10.7 in favor of Secure Transport and Common Crypto. Furthermore, OpenSSL is not even supported on iOS. See: https://developer.apple.com/library/ios/documentation/Security/Conceptual/cryptoservices/GeneralPurposeCrypto/GeneralPurposeCrypto.html https://developer.apple.com/library/ios/documentation/Securi...
nerdy 11y ago
> Good that OS X will update to a more recent version in El Capitan and also switch to LibreSSL (great step forward). Not sure if you're being sarcastic? "LibreSSL has the affected code and is thought to be vulnerable (untested)." - https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang/ https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang...
- smhenderson 11y ago
  They released updates today that fix cve-2015-1788. https://github.com/libressl-portable/portable/blob/master/ChangeLog https://github.com/libressl-portable/portable/blob/master/Ch...
- therealmarv 11y ago
  Can you explain why LibreSSL is a bad choice for the next OS X version? Maybe OpenSSL & LibreSSL are not fixed on exactly the same day (but around the same time region) but this is not bad IMHO.
  - nerdy 11y ago
    Simply saying with regards to this issue it didn't provide advance protection (that was my impression after reading the comment anyhow)
  - zymhan 11y ago
    You claimed that LibreSSL is a great step forward, but there's no reason to think that it's a "great step".
    - glass- 11y ago
      > there's no reason The last time a bunch of OpenSSL CVEs dropped, there were 14 of them; two of which were rated sev: High. LibreSSL was affected by 5 out of the 14, none of which were high-severity. This time around there are seven vulnerabilities and LibreSSL is affected by four of them[1]. So there's at least 12 reasons. [0] https://marc.info/?l=openbsd-cvs&m=142677372515025&w=2 [1] https://marc.info/?l=openbsd-announce&m=143406498020131&w=2
- glass- 11y ago
  There were 7 CVEs of which 4 were applicable to LibreSSL, including the one in that link.

Good luck in updating it in OS X (try running `ssh -V` there). Good that OS X will update to a more recent version in El Capitan and also switch to LibreSSL (great step forward).

nifoc 11y ago

SSH under OS X uses OSSLShim, which is wrapper around Secure Transport. I'm not exactly sure when they started using it for this, but it has been a while. If you're seeing OpenSSL in the output, you have probably installed SSH via Homebrew.

9700094 11y ago
These are the versions on 10.10.3: OpenSSL 0.9.8zd 8 Jan 2015 OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
therealmarv 11y ago
ah ok thanks. Actually I do not see OpenSSL there. I've looked too fast and thought OpenSSL is still used in OS X.
sslalready 11y ago
Usage of openssl has been deprecated since OS X 10.7 in favor of Secure Transport and Common Crypto. Furthermore, OpenSSL is not even supported on iOS. See: https://developer.apple.com/library/ios/documentation/Security/Conceptual/cryptoservices/GeneralPurposeCrypto/GeneralPurposeCrypto.html https://developer.apple.com/library/ios/documentation/Securi...

nerdy 11y ago

> Good that OS X will update to a more recent version in El Capitan and also switch to LibreSSL (great step forward). Not sure if you're being sarcastic? "LibreSSL has the affected code and is thought to be vulnerable (untested)." - https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang/ https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang...

smhenderson 11y ago
They released updates today that fix cve-2015-1788. https://github.com/libressl-portable/portable/blob/master/ChangeLog https://github.com/libressl-portable/portable/blob/master/Ch...
therealmarv 11y ago
Can you explain why LibreSSL is a bad choice for the next OS X version? Maybe OpenSSL & LibreSSL are not fixed on exactly the same day (but around the same time region) but this is not bad IMHO.
- nerdy 11y ago
  Simply saying with regards to this issue it didn't provide advance protection (that was my impression after reading the comment anyhow)
- zymhan 11y ago
  You claimed that LibreSSL is a great step forward, but there's no reason to think that it's a "great step".
  - glass- 11y ago
    > there's no reason The last time a bunch of OpenSSL CVEs dropped, there were 14 of them; two of which were rated sev: High. LibreSSL was affected by 5 out of the 14, none of which were high-severity. This time around there are seven vulnerabilities and LibreSSL is affected by four of them[1]. So there's at least 12 reasons. [0] https://marc.info/?l=openbsd-cvs&m=142677372515025&w=2 [1] https://marc.info/?l=openbsd-announce&m=143406498020131&w=2
glass- 11y ago
There were 7 CVEs of which 4 were applicable to LibreSSL, including the one in that link.