New version of OpenSSL closes security holes in ASN1 parser

ronjor · Apr 20, 2012

Tavis Ormandy from the Google Security Team has notified the OpenSSL developers of a security hole in the current version of their open source library. The errors occur when parsing ASN1 data via the asn1_d2i_read_bio() function. According to the official OpenSSL advisory and Ormandy's message, the issue affects applications that process external X.509 certificates or public RSA keys. However, the remaining information about the applications that are affected, and the potential consequences, is rather cryptic.
Click to expand...

http://www.h-online.com/security/ne...es-security-holes-in-ASN1-parser-1543932.html

Log in or Sign up

New version of OpenSSL closes security holes in ASN1 parser

ronjor Global Moderator

Log in or Sign up

New version of OpenSSL closes security holes in ASN1 parser

ronjor Global Moderator

Useful Searches