News for hackers. Stuff that matters.

A comment on Remote code execution vulnerability in apt/apt-get. Parent comment

Re:Remote code execution vulnerability in apt/apt-get by raesene9 on Tuesday January 22, 2019 @12:08PM (#18969896)
OpenSSL is not the only available implementation of SSL.
[ Parent | on HN ]
Re:Remote code execution vulnerability in apt/apt-get by detaro on Tuesday January 22, 2019 @12:12PM (#18969934)
Realistically, it's the one that's gonna be used in apt though. (E.g. the existing HTTPS transport uses curl, which uses OpenSSL)
[ Parent | on HN ]
Re:Remote code execution vulnerability in apt/apt-get by jwilk on Tuesday January 22, 2019 @12:25PM (#18970099)
libcurl has many TLS backends. APT before 1.6 actually uses the GnuTLS one.

APT ≥ 1.6 doesn't use libcurl; it uses GnuTLS directly.

[ Parent | on HN ]
Re:Remote code execution vulnerability in apt/apt-get by detaro on Tuesday January 22, 2019 @12:27PM (#18970131)
I stand corrected, thx.
[ Parent | on HN ]
Re:Remote code execution vulnerability in apt/apt-get by raesene9 on Tuesday January 22, 2019 @12:15PM (#18969970)
Sure, my point was more that if it's a serious concern to use OpenSSL (Personally I don't think it is, as a lot of work has been done in recent years to improve that codebase), that other options are available.
[ Parent | on HN ]