News for hackers. Stuff that matters.

A comment on The Heartbleed Bug.

Re:The Heartbleed Bug by mstrem on Monday April 07, 2014 @06:52PM (#7550201)
From the CloudFlare blog: "This bug fix is a successful example of what is called responsible disclosure".

I just discovered this now and

    yum info openssl
Yields 1.0.1e as available package which is vulnerable. I guess not all "stakeholders" have been warned properly - or am I jumping to conclusions?
[ Parent | on HN ]
Re:The Heartbleed Bug by jlgaddis on Monday April 07, 2014 @08:01PM (#7550531)
Apparently Red Hat, Debian, and Ubuntu weren't (from what I gather from reading mailing list posts) -- no idea who else.

That's not responsible at all, IMO. Whoever was in charge of this (NCSC-FI?) isn't very good at coordinating.

[ Parent | on HN ]
Re:The Heartbleed Bug by tiagocruz on Monday April 07, 2014 @11:32PM (#7551299)
https://rhn.redhat.com/errata/RHSA-2014-0376.html
[ Parent | on HN ]
Re:The Heartbleed Bug by vilda on Monday April 07, 2014 @07:20PM (#7550355)
Note that distributions usually don't change the library version, they just apply the fix. Look for distribution-specific sub-version.
[ Parent | on HN ]