Forthcoming OpenSSL Releases – Critical Issue in OpenSSL 3

https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html

by TimWolla • 4 years ago

61 6 4 years ago

mta.openssl.org

SLWW• 4 years ago

RCE and unprivileged access to memory? (to dump keys and the like)

seems fun

yuvadam• 4 years ago

This seems to affect only OpenSSL 3.x.x

Most distros have never bothered to upgrade to major version 3 - possibly because it broke ABI backwards compatibility - so despite the critical severity the impact might not be as widespread as it could have been?

TimWolla• 4 years ago

OpenSSL 3 is in Ubuntu 22.04 LTS [1]. I expect that alone to be bad enough.

[1] https://discourse.ubuntu.com/t/jammy-jellyfish-release-notes...

hedora• 4 years ago

It is in fedora and debian testing, but not stable. It made it into redhat 9, but none of the earlier ones or centos.

Source:

https://distrowatch.com/

Oddly, they say it is in openbsd. I thought they moved off openssl years ago. (It might be good to take the other things I said with a grain of salt.)

midislack• 4 years ago

No cute name / logo for this one?

Forthcoming OpenSSL Releases – Critical Issue in OpenSSL 3

Related Stories