Date: Tue, 27 Apr 2010 11:31:20 -0400 From: "Brian A. Seklecki (CFI NOC)" <seklecki@noc.cfi.pgh.pa.us> To: Remko Lodder <remko@elvandar.org> Cc: freebsd-security@freebsd.org Subject: Re: OpenSSL CVE-2009-4355 Message-ID: <4BD70348.6010901@noc.cfi.pgh.pa.us> In-Reply-To: <1264017412.18129.38.camel@soundwave.ws.pitbpa0.priv.collaborativefusion.com> References: <1264017412.18129.38.camel@soundwave.ws.pitbpa0.priv.collaborativefusion.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 1/20/2010 2:56 PM, Brian A. Seklecki wrote:
> Per Daniele Sluijters's inquiry on the 15th,CVE-2009-4355, as
> well as with a provision/draft fix for CVE-2009-3555
> MITM/Renegotiation Venerability.
All:
Did anyone ever come to a finding on CVE-2009-4355?
Using the comments in Redhat Bugzilla, I was never able
to re-create it on RELENG_6_3.
Of course, RELENG_6_3, RELENG_7_2, and RELENG_8 are still
behind OpenSSL 0.9.8m. FreeBSD9-Current seems to have 1.x-latest
- NetBSD fixed it in 5.0.2:
http://cvsweb.de.netbsd.org/cgi-bin/cvsweb.cgi/src/crypto
/dist/openssl/crypto/comp/Attic/c_zlib.c
- RHEL/Fedora patched their OpenSSL RPMs months ago.
Without widespread working DoS code in the wild, are we happy
instead, with patches to userland/ports etc.? Apache
httpd 2.2.15 and php5.3.2 in Ports?
Thanks,
~BAS
> I suspect we wont have a patch out for RELENG_6_3 by the 31st?
> But I'm willing to maintain one for another few months.
>
> -------- Forwarded Message --------
> From: OpenSSL<openssl@openssl.org>
> Reply-to: openssl-users@openssl.org
> To: openssl-users@openssl.org, openssl-announce@openssl.org
> Subject: OpenSSL 1.0.0 beta5 release
> Date: Wed, 20 Jan 2010 19:19:16 +0100
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4BD70348.6010901>