Security News
A proof-of-concept exploit has been made public for a recently patched vulnerability in OpenSSL that can be exploited for denial-of-service attacks. OpenSSL versions 1.1.1d, 1.1.1e and 1.1.1f are affected by a high-severity vulnerability that has been described as a segmentation fault in the SSl check chain function.
A static analysis feature set to appear in GCC 10, which will catch common programming errors that can lead to security vulnerabilities, has scored an early win - it snared an exploitable flaw in OpenSSL. Bernd Edlinger discovered CVE-2020-1967, a denial-of-service flaw deemed to be a high severity risk by the OpenSSL team. While the flaw is an irritation - it's not remote-code execution but it can potentially hose servers and apps - programmers may be more interested in how it was uncovered.
An update released on Tuesday for OpenSSL patches a high-severity vulnerability that can be exploited for denial-of-service attacks. The vulnerability impacts OpenSSL versions 1.1.1d, 1.1.1e and 1.1.1f, and it has been patched with the release of version 1.1.1g. Older versions 1.0.2 and 1.1.0, which no longer receive security updates, are not impacted by the flaw.
OpenSSL has evolved a great deal in terms of security since the disclosure of the Heartbleed vulnerability back in 2014. read more
Blue Cedar has joined an industry initiative to develop the open-source FIPS 140-2 module for OpenSSL. Blue Cedar will collaborate with Open SSL, Akamai, NetApp, and VMware, in the effort to...
The OpenSSL Project on Tuesday announced the release of OpenSSL 1.1.1, the new Long Term Support (LTS) version of the cryptographic software library. read more
'One and Done' attack patched in library's May 2018 release If you missed the OpenSSL update released in May, go back and get it: a Georgia Tech team recovered a 2048-bit RSA key from OpenSSL...
The first round of security updates released in 2018 for OpenSSL patch a total of three vulnerabilities, but none of them appears to be serious. OpenSSL versions 1.1.0h and 1.0.2o patch...
The OpenSSL Project announced on Thursday the availability of OpenSSL 1.0.2n, a version that patches two vulnerabilities discovered by a Google researcher. read more
OpenSSL updates released on Thursday patch two low and medium severity vulnerabilities discovered using Google’s open source OSS-Fuzz fuzzing service. read more