Re:OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f
by nayuki on Tuesday April 21, 2020 @01:28PM
(#22937092)
What popular software contain these vulnerable versions of the OpenSSL library?
[ Parent
| on HN ]
Re:OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f
by erichdongubler on Tuesday April 21, 2020 @01:43PM
(#22937313)
This is a good question. Also important to remember is that for many Linux distributions dynamically linked OpenSSL artifacts are what end up getting used by the vast majority of binaries.
Re:OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f
by jolmg on Tuesday April 21, 2020 @02:30PM
(#22937858)
Yeah, I was thinking by all of the binaries. I had forgotten that there's software that bundle it independently of the distro's library. Another comment mentioned docker images, and I've remembered that ruby also bundles it for its own use.
Re:OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f
by AngeloR on Tuesday April 21, 2020 @01:51PM
(#22937401)
I have no idea what a full list looks like.. but the nginx:1.17.10-alpine docker image contains the following:
/ # nginx -V
nginx version: nginx/1.17.10
built by gcc 9.2.0 (Alpine 9.2.0)
built with OpenSSL 1.1.1d 10 Sep 2019
Re:OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f
by ajp on Tuesday April 21, 2020 @05:30PM
(#22939523)
Mine has a "running with..." part after that.
built with OpenSSL 1.1.1d 10 Sep 2019 (running with OpenSSL 1.1.1g 21 Apr 2020)
Re:OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f
by sigotirandolas on Tuesday April 21, 2020 @09:47PM
(#22941220)
If it doesn't print the "running with" line, it's running with the same version it was built with:
https://hg.nginx.org/nginx/file/stable-1.18/src/core/nginx.c...