3 ms·

Here's a writeup of CVE-2015-1788: https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang/ https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang..

by ctz 11y ago

Here's a writeup of CVE-2015-1788: https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang/ https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang... It's embarrassing rather than terribly dangerous. edit: Please note: there are other issues in this advisory. You should read the advisory, first and foremost.

koenigdavidmj 11y ago
Your comment is probably correct regarding that one issue, but multiple issues were announced today. These include CVE-2015-4000, which is another nasty downgrade issue. (I'm mostly posting this because I don't want anyone to read your post and think they can ignore this whole notice.)
- tptacek 11y ago
  I think Logjam is the only operationally significant bug in this announcement.
- ctz 11y ago
  You're right, of course. But CVE-2015-4000 was announced and extensively discussed a number of weeks ago: https://weakdh.org/ https://weakdh.org/
smhenderson 11y ago
Well, with updates to LibreSSL (2.1.7, 2.2.0) getting released today it looks like this has already been addressed. I can't find a decent link at the moment but according to an email I received a bit ago from owner-announce at openbsd.org 1788 is fixed in the above mentioned releases. Fixes for the following issues are integrated into LibreSSL 2.1.7 and LibreSSL 2.2.0: - CVE-2015-1788 - Malformed ECParameters causes infinite loop - CVE-2015-1789 - Exploitable out-of-bounds read in X509_cmp_time - CVE-2015-1792 - CMS verify infinite loop with unknown hash function (this code is not enabled by default) Edit - The updates included are mentioned here: https://github.com/libressl-portable/portable/blob/master/ChangeLog https://github.com/libressl-portable/portable/blob/master/Ch...