More OpenSSL security fixes

FanJ · Jan 15, 2024

OpenSSL Security Advisory [15th January 2024]
Excessive time spent checking invalid RSA public keys (CVE-2023-6237)
https://mta.openssl.org/pipermail/openssl-announce/2024-January/000289.html

Severity: Low
Click to expand...

The OpenSSL SSL/TLS implementation is not affected by this issue.
The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.
OpenSSL versions 3.0.0 to 3.0.12, 3.1.0 to 3.1.4 and 3.2.0 are vulnerable to
this issue.
OpenSSL versions 1.1.1 and 1.0.2 are not affected by this issue.
Click to expand...

Due to the low severity of this issue we are not issuing new releases of
OpenSSL at this time. The fix will be included in the next releases when they
become available. The fix is also available in commit 0b0f7abf (for 3.2),
commit a830f551 (for 3.1) and commit 18c02492 (for 3.0) in the OpenSSL git
repository.
Click to expand...

FanJ · Jan 26, 2024

New OpenSSL Releases
By Tomas Mraz - Tue Jan 23 16:26:59 UTC 2024
https://mta.openssl.org/pipermail/openssl-announce/2024-January/000291.html

The OpenSSL project team would like to announce the upcoming release of
OpenSSL versions 3.2.1, 3.1.5 and 3.0.13.

We will be also releasing extended support OpenSSL versions 1.0.2zj and
1.1.1x which will be available to premium support customers.

These releases will be made available on Tuesday 30th January 2024
between 1300-1700 UTC.

These are security-fix releases. The highest severity issue fixed in
each of these releases is Low
Click to expand...

Note by me:
With all due respect, I do prefer the announcements made by Matt Caswell:
OpenSSL Security Advisory
By Matt Caswell - Thu Jan 25 18:43:35 UTC 2024
https://mta.openssl.org/pipermail/openssl-announce/2024-January/000292.html

FanJ · Mar 20, 2024

Upcoming Webinar: Writing Your First OpenSSL Application
Tue Mar 19 07:46:07 UTC 2024
https://mta.openssl.org/pipermail/openssl-announce/2024-March/000296.html

We are thrilled to announce our upcoming webinar, Writing Your First
OpenSSL Application.

This webinar is designed to take you from an understanding of basic
cryptography concepts to writing your first secure application using
OpenSSL. It's the perfect starting point for anyone looking to dive into
the world of secure application development. Here's what we'll cover:
Click to expand...

*Event Details*

* *Date:* Mar 28, 2024
* *Time:* 09:00 AM Pacific Time (US and Canada)
* *Location:* Online (Zoom)
Click to expand...

Read there more.

FanJ · Mar 20, 2024

OpenSSL version 3.3.0-alpha1 published
Wed Mar 20 13:35:23 UTC 2024
https://mta.openssl.org/pipermail/openssl-announce/2024-March/000297.html

OpenSSL 3.3 is currently in alpha.

OpenSSL 3.3 alpha 1 has now been made available.

Note: This OpenSSL pre-release has been provided for testing ONLY.
It should NOT be used for security critical purposes.
Click to expand...

Read there more.

FanJ · Mar 30, 2024

OpenSSL version 3.3.0-beta1 published
Fri Mar 29 14:58:40 UTC 2024
https://mta.openssl.org/pipermail/openssl-announce/2024-March/000298.html

OpenSSL 3.3 beta 1 has now been made available.

Note: This OpenSSL pre-release has been provided for testing ONLY.
It should NOT be used for security critical purposes.
Click to expand...

Read there more.

FanJ · Apr 8, 2024

OpenSSL Security Advisory
Mon Apr 8 13:59:11 UTC 2024
https://mta.openssl.org/pipermail/openssl-announce/2024-April/000299.html

OpenSSL Security Advisory [8th April 2024]

Unbounded memory growth with session handling in TLSv1.3 (CVE-2024-2511)
Click to expand...

Severity: Low
Click to expand...

Issue summary: Some non-default TLS server configurations can cause unbounded
memory growth when processing TLSv1.3 sessions

Impact summary: An attacker may exploit certain server configurations to trigger
unbounded memory growth that would lead to a Denial of Service
Click to expand...

This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS
clients.
Click to expand...

Read there more.

FanJ · Apr 9, 2024

OpenSSL version 3.3.0 published
Tue Apr 9 12:56:00 UTC 2024
https://mta.openssl.org/pipermail/openssl-announce/2024-April/000300.html

OpenSSL version 3.3.0 released
==============================

OpenSSL - The Open Source toolkit for SSL/TLS
https://www.openssl.org/

The OpenSSL project team is pleased to announce the release of
version 3.3.0 of our open source toolkit for SSL/TLS.
For details of the changes, see the release notes at:

https://www.openssl.org/news/openssl-3.3-notes.html

Specific notes on upgrading to OpenSSL 3.3 from previous versions are
available in the OpenSSL Migration Guide, here:

https://www.openssl.org/docs/man3.3/man7/migration_guide.html
Click to expand...

Read there more!

FanJ · Apr 17, 2024

Upcoming Webinar: Writing a TLS Client
Tue Apr 16 05:37:52 UTC 2024
https://mta.openssl.org/pipermail/openssl-announce/2024-April/000301.html

We are pleased to announce our upcoming webinar, Writing a TLS Client.

In this webinar we will cover writing a simple TLS client using the
OpenSSL APIs. The webinar will cover how to write an application that
connects to a server and securely exchanges data using TLS using the
OpenSSL API.
At the end of the webinar we will host a Q&A session, giving you the
opportunity to have your questions answered by OpenSSL developers.

Event Details

* *Date*: April 25, 2024
* *Time*: 09:00 AM Pacific Time (US and Canada)
* *Location*: Online (Zoom)
Click to expand...

Read there more.

Log in or Sign up

More OpenSSL security fixes

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

Log in or Sign up

More OpenSSL security fixes

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

Useful Searches