Discussion:
Vuln in SSL 3.0
Krzysztof Kwiatkowski
2014-10-14 14:19:18 UTC
Permalink
Hi,

Any idea what this is about? Is it a threat for OpenSSL users:

http://www.theregister.co.uk/2014/10/14/nasty_ssl_30_vulnerability_to_drop_tomorrow/

Regards,
Kris
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List openssl-***@openssl.org
Automated List Manager ***@openssl.org
Dominyk Tiller
2014-10-14 16:19:34 UTC
Permalink
If there is a threat in SSLv3 it seems almost certain to affect OpenSSL.

The upstream dev team not commenting on this is probably fairly
standard protocol; I believe they don't comment on anything critical
that could be exploited before patches are imminent or available.

I guess the situation is "Watch this space".

Sent from Thunderbird for OS X. My PGP public key is automatically
attached to this email.
Post by Krzysztof Kwiatkowski
Hi,
http://www.theregister.co.uk/2014/10/14/nasty_ssl_30_vulnerability_to_drop_tomorrow/
Regards, Kris
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Post by Krzysztof Kwiatkowski
Development Mailing List
n***@free.fr
2014-10-15 13:43:52 UTC
Permalink
Hi,

there's a workaround here : https://tools.ietf.org/html/draft-ietf-tls-downgrade-scsv-00

it aims to forbid protocol downgrade, except for interoperability
however I don't know when draft will be accepted and included to TLS protocols

Nicolas


----- Mail original -----
De: "Dominyk Tiller" <***@gmail.com>
À: openssl-***@openssl.org
Envoyé: Mardi 14 Octobre 2014 18:19:34
Objet: Re: Vuln in SSL 3.0

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

If there is a threat in SSLv3 it seems almost certain to affect OpenSSL.

The upstream dev team not commenting on this is probably fairly
standard protocol; I believe they don't comment on anything critical
that could be exploited before patches are imminent or available.

I guess the situation is "Watch this space".

Sent from Thunderbird for OS X. My PGP public key is automatically
attached to this email.
Post by Krzysztof Kwiatkowski
Hi,
http://www.theregister.co.uk/2014/10/14/nasty_ssl_30_vulnerability_to_drop_tomorrow/
Regards, Kris
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Post by Krzysztof Kwiatkowski
Development Mailing List
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJUPU0UAAoJEIclJNuddDJsNYUP/A00vuZ/PUsoIG/rORgw9yvj
Gg9IIfybSodxdVpeQeI98z1wxEh4+6p99MYmZTvJ3RnRATrMn2ymjrYbJz4Jj43q
0d3kg3QQCPnPimFkgCo2IwdT/K2TCZl2pAwIOJn5Mo25nGnVL7WpH62PXjtBLpvz
Im7WME5W8qzhZ+cHQJA3A+P5ow9q+aS++/bNk/dq80EON4/gyxRvu/BNl+/DmCfw
2SKP57k8huHj5F0voziNPKLPd2RBtgxS9iAEVZ9bmWLLTxdfTfTs19+VZRm2yyXw
KFM2DbeWJORrWkxO0yDPS5FNVv54brkmvu8Iu7Ge3fbYNXSAe5SKJMhmwiXone7S
XZFLY9KceZjj1jrX9JLDE8Ivp/gp+9W2LrafguZhYnSeZ2SRtx/vDloPDKrv1V/N
ny2EudnX+vN6KRMqfpcGc/NR3/ODfkHkXfKVuZ056oPxsSBCFJSzlVl2gDfMTCDV
fH+emZEN2lN9okRIbZadNlGy8Ef34ZvX52CzBonA1u30YI/PiSjiC+8l8HxjEDJv
VhZSJb2dwMJX/7AtXGcEL9C9avRmfzjFullbaCM5HDnKlwvUC/04HkYuydft66XW
VrILhscdrGiBOIiQTaJuiJPBavSQEt8LCYpZOS74icvlB5RzI8Mk8I6V976XzBoS
QAGulIxAp/+CYisBYr6j
=3vi3
-----END PGP SIGNATURE-----
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List openssl-***@openssl.org
Automated List Manager ***@openssl.org
Matt Caswell
2014-10-15 13:59:13 UTC
Permalink
Post by n***@free.fr
Hi,
https://tools.ietf.org/html/draft-ietf-tls-downgrade-scsv-00
it aims to forbid protocol downgrade, except for interoperability
however I don't know when draft will be accepted and included to TLS protocols
The latest versions of OpenSSL that have just been released today
implement this capability.

Matt

______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List openssl-***@openssl.org
Automated List Manager ***@openssl.org
Krzysztof Kwiatkowski
2014-10-15 22:35:56 UTC
Permalink
Great!
I suppose it fixes both - client and server ?
Post by Matt Caswell
Post by n***@free.fr
Hi,
https://tools.ietf.org/html/draft-ietf-tls-downgrade-scsv-00
it aims to forbid protocol downgrade, except for interoperability
however I don't know when draft will be accepted and included to TLS protocols
The latest versions of OpenSSL that have just been released today
implement this capability.
Matt
______________________________________________________________________
OpenSSL Project http://www.openssl.org
--
Sent from my Android device with K-9 Mail. Please excuse my brevity.
Salz, Rich
2014-10-15 22:55:17 UTC
Permalink
Post by Krzysztof Kwiatkowski
I suppose it fixes both - client and server ?
The server-side is automatic: when it sees the SCSV fallback, it sends a fatal alert back to the client.

Clients that will do fallback must call a new API; see the changes file.

--
Principal Security Engineer, Akamai Technologies
IM: ***@jabber.me Twitter: RichSalz


:��I"Ϯ��r�m���� (����Z+�7�zZ)���1���x ��h����W^��^��%��
Loading...