Re:OpenSSL Key Recovery Attack on DH small subgroups (CVE-20...
by blakesterz on Thursday January 28, 2016 @11:23AM
(#10989059)
I struggle with this sometimes too! So often I read the report and I'm left wondering if I should panic or not, so I start reading comments here and elsewhere to figure out if I need to get this patched OMG RIGHT NOW or I can hold off until the weekend.
I would LOVE a clear "should I do emergency patching? yes/no" it seems like it would be frequently (maybe not always?) something that could be added to an announcement.
Re:OpenSSL Key Recovery Attack on DH small subgroups (CVE-20...
by jvehent on Thursday January 28, 2016 @11:34AM
(#10989160)
That's what your local security team should be for ;) At Mozilla, we track those and inform the various ops teams of our assessments. They very much rely on us to decide if it warrants emergency patching or not (modulo operational concerns to upgrade systems outside maintenance windows).
Re:OpenSSL Key Recovery Attack on DH small subgroups (CVE-20...
by detaro on Thursday January 28, 2016 @12:06PM
(#10989429)
Not so great an option if the closest thing to a "local security team" is the sysadmin asking the question ;)
Re:OpenSSL Key Recovery Attack on DH small subgroups (CVE-20...
by tokenizerrr on Thursday January 28, 2016 @01:21PM
(#10990056)
That's great. Now what about smaller companies which have one, maybe two sysadmins?
Re:OpenSSL Key Recovery Attack on DH small subgroups (CVE-20...
by kroeckx on Thursday January 28, 2016 @06:00PM
(#10992172)
I tried to be clear in when you're vulnerable and when not, so that you can decide if you're vulnerable or not. The answer in this case is "it depends, very likely not".
Re:OpenSSL Key Recovery Attack on DH small subgroups (CVE-20...
by sarciszewski on Thursday January 28, 2016 @12:20PM
(#10989551)
This is a good point. I'll be sure to put that at the top of any vulnerabilities I report in the future.
That said, it's a serious issue, no doubt about that.