Date: Wed, 09 Apr 2014 16:01:28 +0200 From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= <des@des.no> To: Bryan Drewery <bdrewery@FreeBSD.org> Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org, Xin LI <delphij@freebsd.org>, secteam@FreeBSD.org Subject: Re: svn commit: r264265 - in head: crypto/openssl/crypto/bn crypto/openssl/crypto/ec crypto/openssl/ssl sys/fs/nfsserver Message-ID: <86bnwa7gav.fsf@nine.des.no> In-Reply-To: <e25208600d1ed778a20d6ac8596c658a@shatow.net> (Bryan Drewery's message of "Tue, 08 Apr 2014 15:55:18 -0500") References: <201404081827.s38IRXiL048987@svn.freebsd.org> <e25208600d1ed778a20d6ac8596c658a@shatow.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Bryan Drewery <bdrewery@FreeBSD.org> writes: > Also, that this was a partial release of 1.0.1g is confusing a LOT of > users. They think they are still vulnerable. They expect to see 1.0.1g > in 'openssl version'. We could have our own version string in 'openssl > version' to remedy this. This is no different from what other OSes do, e.g. RHEL6.5: % cat /etc/redhat-release=20 Red Hat Enterprise Linux Workstation release 6.5 (Santiago) % openssl version OpenSSL 1.0.1e-fips 11 Feb 2013 % TZ=3DUTC rpm -qi openssl Name : openssl Relocations: (not relocatable) Version : 1.0.1e Vendor: Red Hat, Inc. Release : 16.el6_5.7 Build Date: Mon 07 Apr 2014 11:= 34:45 AM UTC Install Date: Tue 08 Apr 2014 05:18:52 AM UTC Build Host: x86-027.buil= d.eng.bos.redhat.com [...] which despite the version number and date is *not* vulnerable. DES --=20 Dag-Erling Sm=C3=B8rgrav - des@des.no
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?86bnwa7gav.fsf>