From owner-freebsd-security@FreeBSD.ORG  Tue Apr  8 19:21:42 2014
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 22B0F90E
 for <freebsd-security@freebsd.org>; Tue,  8 Apr 2014 19:21:42 +0000 (UTC)
Received: from smarthost1.sentex.ca (smarthost1.sentex.ca
 [IPv6:2607:f3e0:0:1::12])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (Client CN "smarthost.sentex.ca", Issuer "smarthost.sentex.ca" (not verified))
 by mx1.freebsd.org (Postfix) with ESMTPS id DFE9918E8
 for <freebsd-security@freebsd.org>; Tue,  8 Apr 2014 19:21:41 +0000 (UTC)
Received: from [IPv6:2607:f3e0:0:4:f025:8813:7603:7e4a] (saphire3.sentex.ca
 [IPv6:2607:f3e0:0:4:f025:8813:7603:7e4a])
 by smarthost1.sentex.ca (8.14.8/8.14.8) with ESMTP id s38JLbbS082423
 for <freebsd-security@freebsd.org>; Tue, 8 Apr 2014 15:21:37 -0400 (EDT)
 (envelope-from mike@sentex.net)
Message-ID: <53444C33.4060408@sentex.net>
Date: Tue, 08 Apr 2014 15:21:23 -0400
From: Mike Tancsa <mike@sentex.net>
Organization: Sentex Communications
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
 rv:24.0) Gecko/20100101 Thunderbird/24.4.0
MIME-Version: 1.0
To: freebsd-security@freebsd.org
Subject: Re: FreeBSD's heartbleed response
References: <20140408174210.GA5433@behemoth>
 <CAMCLrkFXsnY-_KCw2PF0VtY6C0J-4CL03GzFskXmzUtLL2Ebig@mail.gmail.com>
 <20140408195049.04129f2a@azsupport.com>
 <20140408190227.70A5CDB9@hub.freebsd.org>
In-Reply-To: <20140408190227.70A5CDB9@hub.freebsd.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Scanned-By: MIMEDefang 2.74
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "Security issues \[members-only posting\]"
 <freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security/>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 08 Apr 2014 19:21:42 -0000

On 4/8/2014 2:54 PM, Niklaus Schiess wrote:
> Plenty of FreeBSD deployments use 1.0.1x due to the lack of TLS 1.2
> support in 0.9.x. So thats not an excuse.

The FreeBSD security team only maintains advisories for the base 
distributions. What people install from the ports are not covered by 
those advisories.

Issues affecting the FreeBSD Ports Collection are covered in 
http://vuxml.freebsd.org/

	---Mike


-- 
-------------------
Mike Tancsa, tel +1 519 651 3400
Sentex Communications, mike@sentex.net
Providing Internet services since 1994 www.sentex.net
Cambridge, Ontario Canada   http://www.tancsa.com/