oss-security - openssl security issue or not? (CVE Request?)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120323161320.GD28663@suse.de>
Date: Fri, 23 Mar 2012 17:13:20 +0100
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Cc: inestlerode@...ibm.com
Subject: openssl security issue or not? (CVE Request?)

Hi folks, Ivan,

This patch:
http://cvs.openssl.org/chngview?cn=22161
fixes a decrypt error return values and according to the changelog
"detects symmetric crypto errors" 

I am not sure if this counts as security issue in the end, but "not
detecting a failed decrypt" seems to me like it is a security issue.

Any comments?

Ciao, Marcus
(also https://bugzilla.novell.com/show_bug.cgi?id=749210 )

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.