OpenSSL OpenSSL 1.1.0i and OpenSSL 1.0.2p released

buik · Aug 15, 2018

OpenSSL 1.1.0i and OpenSSL 1.0.2p are now available, including bug and security fixes.

/index.html
openssl/openssl

eva2000 · Aug 15, 2018

cheers, I actually patched OpenSSL 1.1.0h with the fix which is in OpenSSL 1.1.0i for Centmin Mod 123.09beta01. But good to know the security fixes landed in OpenSSL 1.1.0i. They were low severity security bugs so OpenSSL delayed fixes until 1.1.0i and 1.0.2p but I patched them for Centmin Mod 123.09beta01's Nginx + OpenSSL 1.1.0h.

/news/vulnerabilities.html

CVE-2018-0732 (OpenSSL advisory) [Low severity] 12 June 2018:
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Reported by Guido Vranken.

Fixed in OpenSSL 1.1.0i (git commit) (Affected 1.1.0-1.1.0h)

Fixed in OpenSSL 1.0.2p (git commit) (Affected 1.0.2-1.0.2o)

CVE-2018-0737 (OpenSSL advisory) [Low severity] 16 April 2018:
The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Reported by Alejandro Cabrera Aldaya, Billy Brumley, Cesar Pereida Garcia and Luis Manuel Alvarez Tapia.

Fixed in OpenSSL 1.1.0i (git commit) (Affected 1.1.0-1.1.0h)

Fixed in OpenSSL 1.0.2p (git commit) (Affected 1.0.2-1.0.2o)

Click to expand...

Log in / Register

Forums

Join the community today

OpenSSL OpenSSL 1.1.0i and OpenSSL 1.0.2p released

buik Well-Known Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Join the community today

OpenSSL OpenSSL 1.1.0i and OpenSSL 1.0.2p released

buik Well-Known Member

eva2000 Administrator Staff Member

.