OpenSSL Security Advisory

Re:OpenSSL Security Advisory by therealmarv on Thursday June 11, 2015 @11:25AM (#9700252)

Good luck in updating it in OS X (try running `ssh -V` there). Good that OS X will update to a more recent version in El Capitan and also switch to LibreSSL (great step forward).

[ Parent | on HN ]

Re:OpenSSL Security Advisory by nifoc on Thursday June 11, 2015 @11:38AM (#9700329)

SSH under OS X uses OSSLShim, which is wrapper around Secure Transport. I'm not exactly sure when they started using it for this, but it has been a while.

If you're seeing OpenSSL in the output, you have probably installed SSH via Homebrew.

[ Parent | on HN ]

Re:OpenSSL Security Advisory by sslalready on Thursday June 11, 2015 @05:36PM (#9702612)

Usage of openssl has been deprecated since OS X 10.7 in favor of Secure Transport and Common Crypto. Furthermore, OpenSSL is not even supported on iOS. See: https://developer.apple.com/library/ios/documentation/Securi...

[ Parent | on HN ]

Re:OpenSSL Security Advisory by 9700094 on Thursday June 11, 2015 @12:18PM (#9700567)

These are the versions on 10.10.3:

OpenSSL 0.9.8zd 8 Jan 2015

OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011

[ Parent | on HN ]

Re:OpenSSL Security Advisory by therealmarv on Thursday June 11, 2015 @01:05PM (#9700910)

ah ok thanks. Actually I do not see OpenSSL there. I've looked too fast and thought OpenSSL is still used in OS X.

[ Parent | on HN ]

Re:OpenSSL Security Advisory by nerdy on Thursday June 11, 2015 @11:39AM (#9700336)

> Good that OS X will update to a more recent version in El Capitan and also switch to LibreSSL (great step forward).

Not sure if you're being sarcastic?

"LibreSSL has the affected code and is thought to be vulnerable (untested)." - https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang...

[ Parent | on HN ]

Re:OpenSSL Security Advisory by smhenderson on Thursday June 11, 2015 @12:58PM (#9700861)

They released updates today that fix cve-2015-1788.

https://github.com/libressl-portable/portable/blob/master/Ch...

[ Parent | on HN ]

Re:OpenSSL Security Advisory by therealmarv on Thursday June 11, 2015 @01:06PM (#9700923)

Can you explain why LibreSSL is a bad choice for the next OS X version? Maybe OpenSSL & LibreSSL are not fixed on exactly the same day (but around the same time region) but this is not bad IMHO.

[ Parent | on HN ]

Re:OpenSSL Security Advisory by nerdy on Thursday June 11, 2015 @01:59PM (#9701254)

Simply saying with regards to this issue it didn't provide advance protection (that was my impression after reading the comment anyhow)

[ Parent | on HN ]

Re:OpenSSL Security Advisory by zymhan on Thursday June 11, 2015 @04:30PM (#9702181)

You claimed that LibreSSL is a great step forward, but there's no reason to think that it's a "great step".

[ Parent | on HN ]

Re:OpenSSL Security Advisory by glass- on Thursday June 11, 2015 @07:29PM (#9703103)

> there's no reason

The last time a bunch of OpenSSL CVEs dropped, there were 14 of them; two of which were rated sev: High. LibreSSL was affected by 5 out of the 14, none of which were high-severity.

This time around there are seven vulnerabilities and LibreSSL is affected by four of them[1].

So there's at least 12 reasons.

    [0] https://marc.info/?l=openbsd-cvs&m=142677372515025&w=2
    [1] https://marc.info/?l=openbsd-announce&m=143406498020131&w=2

[ Parent | on HN ]

Re:OpenSSL Security Advisory by glass- on Thursday June 11, 2015 @07:43PM (#9703144)

There were 7 CVEs of which 4 were applicable to LibreSSL, including the one in that link.

[ Parent | on HN ]