[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110704092423.027dc897@redhat.com>
Date: Mon, 4 Jul 2011 09:24:23 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: openssl timing attack
On Mon, 4 Jul 2011 02:52:41 +0400 Solar Designer wrote:
> Question to OpenSSL developers: is the patch given in Billy Bob
> Brumley and Nicola Tuveri's paper "Remote Timing Attacks Are Still
> Practical" OK to be used by distros? Basically, I am interested in
> its "review status" by upstream - reviewed and approved, reviewed but
> not approved for specific reasons, not sufficiently reviewed. (The
> patch is tiny, but even tiny changes might have non-obvious
> implications.)
I'm not part of the group you directed this question too, but as I've
not seen any upstream developer or list in CC...
The fix from the paper was committed in openssl CVS within about a week
from public disclosure:
http://cvs.openssl.org/chngview?cn=20892
However, there were some concerns raised regarding the extra #ifdef
wrapping added as part of the commit, which disable the fix by default,
and the name suggests #ifndef was probably intended:
http://www.mail-archive.com/openssl-dev@openssl.org/msg29283.html
HTH
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
