OpenSSL Hit By New High Severity Security Issue

[phoronix]

Phoronix: OpenSSL Hit By New High Severity Security Issue

OpenSSL has been hit by another "high" severity security vulnerability...

http://www.phoronix.com/scan.php?page=news_item&px=OpenSSL-CVE-2017-3733

[chuckula]

I'm sure this hits some people but most are still on OpenSSL 1.02, even many rolling distros like Arch.

[nomadewolf]

I guess it's time for a new fork...

[Guest]

I think openssl 1.1 is on Arch Linux's todo list.
I personally think it will need work as it touches curl and hence pacman.

Edit: I wish they would migrate curl and its dependent packages to use nss instead of openssl. Fedora does so already if I understand correctly.

[uid313]

We need a new modern suite that is written in Rust and only supports TLS 1.3 with no support for TLS 1.0-1.2 or SSL. No support for MD5 or SHA-1, etc. Minimal, robust, secure.

[torsionbar28]

We need to replace this faulty SSL stuff. I propose hiring a legion of Navajo code talkers.

[devius]

We need to go back to DOS and serial null-modem connections.

[mlau]

We need to go back to DOS and serial null-modem connections.

Ah, the good old times..

[Wingfeather]

Can anyone tell if LibreSSL is/was vulnerable? Although, if this was only introduced with 1.1 then I would guess not...

[kgardas]

It'll be interesting to see if LibreSSL (by OpenBSD team) or BoringSSL (by Google) will be affected by this issue too.