News for hackers. Stuff that matters.

A comment on OpenSSL Security Advisory. Parent comment

Re:OpenSSL Security Advisory by nerdy on Thursday June 11, 2015 @11:39AM (#9700336)
> Good that OS X will update to a more recent version in El Capitan and also switch to LibreSSL (great step forward).

Not sure if you're being sarcastic?

"LibreSSL has the affected code and is thought to be vulnerable (untested)." - https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang...

[ Parent | on HN ]
Re:OpenSSL Security Advisory by smhenderson on Thursday June 11, 2015 @12:58PM (#9700861)
They released updates today that fix cve-2015-1788.

https://github.com/libressl-portable/portable/blob/master/Ch...

[ Parent | on HN ]
Re:OpenSSL Security Advisory by therealmarv on Thursday June 11, 2015 @01:06PM (#9700923)
Can you explain why LibreSSL is a bad choice for the next OS X version? Maybe OpenSSL & LibreSSL are not fixed on exactly the same day (but around the same time region) but this is not bad IMHO.
[ Parent | on HN ]
Re:OpenSSL Security Advisory by nerdy on Thursday June 11, 2015 @01:59PM (#9701254)
Simply saying with regards to this issue it didn't provide advance protection (that was my impression after reading the comment anyhow)
[ Parent | on HN ]
Re:OpenSSL Security Advisory by zymhan on Thursday June 11, 2015 @04:30PM (#9702181)
You claimed that LibreSSL is a great step forward, but there's no reason to think that it's a "great step".
[ Parent | on HN ]
Re:OpenSSL Security Advisory by glass- on Thursday June 11, 2015 @07:29PM (#9703103)
> there's no reason

The last time a bunch of OpenSSL CVEs dropped, there were 14 of them; two of which were rated sev: High. LibreSSL was affected by 5 out of the 14, none of which were high-severity.

This time around there are seven vulnerabilities and LibreSSL is affected by four of them[1].

So there's at least 12 reasons.

    [0] https://marc.info/?l=openbsd-cvs&m=142677372515025&w=2
    [1] https://marc.info/?l=openbsd-announce&m=143406498020131&w=2
[ Parent | on HN ]
Re:OpenSSL Security Advisory by glass- on Thursday June 11, 2015 @07:43PM (#9703144)
There were 7 CVEs of which 4 were applicable to LibreSSL, including the one in that link.
[ Parent | on HN ]