OpenSSL 3.0.7 Published

Re:OpenSSL 3.0.7 Published by m_eiman on Tuesday November 01, 2022 @11:55AM (#33422949)

I suppose this is the "clear your schedule and be prepared to patch the entire world" version?

[ Parent | on HN ]

Re:OpenSSL 3.0.7 Published by input_sh on Tuesday November 01, 2022 @12:16PM (#33423309)

Lots of distros don't use v3 yet and are not affected.

This is definitely far from Heartbleed level of catastrophe.

[ Parent | on HN ]

Re:OpenSSL 3.0.7 Published by TheRealDunkirk on Tuesday November 01, 2022 @12:22PM (#33423396)

Feh. I just upgraded my production and staging machines to Ubuntu 22, which no longer have v1, and which breaks compiling older (but still maintained) versions of Ruby. Everything is still running, but this change caught me flatfooted. I groused about Ubuntu, and someone told me that Fedora has also changed over. You say "lots" of distro's haven't. Which ones? (And, sure, I can already assume Debian stable, since that runs 7 years behind everything else, but what else?)

[ Parent | on HN ]

Re:OpenSSL 3.0.7 Published by macintux on Tuesday November 01, 2022 @12:40PM (#33423634)

This is a good overview of what’s vulnerable:

https://github.com/NCSC-NL/OpenSSL-2022/blob/main/software/R...

[ Parent | on HN ]

Re:OpenSSL 3.0.7 Published by input_sh on Tuesday November 01, 2022 @12:57PM (#33423878)

I'm oversimplifying it a bit, but anything that hasn't reached stable this year is still using v1.1.1 (and therefore unaffected).

Ubuntu v22.04 is vulnerable, but any before it is not. Debian is good (except bookworm which is currently in testing), Fedora (<36) is good, RHEL/CentOS (<9), Arch...

So on top of being not as serious as Heartbleed, servers that are a bit longer in operation (but still well within their support cycle) don't need patching.

https://github.com/NCSC-NL/OpenSSL-2022/tree/main/software

EDIT just to add this quote from their blog post (https://www.openssl.org/blog/blog/2022/11/01/email-address-o...):

> We did release an update to OpenSSL 1.1.1, namely 1.1.1s, also on 1st November 2022, but this is a bug fix release only and does not include any security fixes.

[ Parent | on HN ]

Re:OpenSSL 3.0.7 Published by bscphil on Tuesday November 01, 2022 @05:18PM (#33427618)

> You say "lots" of distro's haven't. Which ones?

Surprisingly enough, Arch Linux, a rolling release distro, still hasn't. It's a real mixed bag.

[ Parent | on HN ]

Re:OpenSSL 3.0.7 Published by phonepostingsux on Tuesday November 01, 2022 @08:16PM (#33429779)

Neither has Gentoo, unless you unmasked 3.0 yourself.

[ Parent | on HN ]

Re:OpenSSL 3.0.7 Published by datalopers on Tuesday November 01, 2022 @11:59AM (#33423041)

OpenSSL 3.x has a fairly small install base

[ Parent | on HN ]

Re:OpenSSL 3.0.7 Published by Sohcahtoa82 on Tuesday November 01, 2022 @01:22PM (#33424255)

In addition to very few distros using OpenSSL 3, your server is only affected if you do client certificate verification, which is exceptionally rare for public internet servers.

As a client, you're only affected if you connect to a malicious server.

[ Parent | on HN ]

Re:OpenSSL 3.0.7 Published by ignaloidas on Tuesday November 01, 2022 @03:46PM (#33426454)

Could in theory be utilized to move laterally in networks where client TLS is used for authentication, which I see used sometimes.

[ Parent | on HN ]