Hacker News new | past | comments | ask | show | jobs | submit login

What I really want to know is does this affect LibreSSL?

That would be an interesting comparison.




I assume you're referring to the memory leaks (CVE-2014-3513 & CVE-2014-3567)? (as there's a few items being patched).

My guess is that it doesn't since OpenSSL use a bespoke memory allocator / deallocator which, if I recall correctly, was one of the things that Theo de Raadt was criticising OpenSSL over.

The TLS_FALLBACK_SCSV patch (re POODLE) was ported from BoringSSL (Google's fork of OpenSSL) to address TLS 1.0 downgrading to SSL 3.0. From what I understand, and I might be wrong on this, this is a protocol issue rather than a bug with specific SSL libraries. So LibreSSL might also see a similar TLS_FALLBACK_SCSV patch applied.


POODLE is a protocol design issue, yes. In short, the padding is not covered by the MAC.


It was reported by LibreSSL.


Did you read the post? They specifically state that it was discovered and patched by LibreSSL.


Yes and I actually missed that bit. I hang my head in shame :(




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: