Menu
OpenSSL releases several patches but none for serious issues

OpenSSL releases several patches but none for serious issues

The encryption application is still being fine-tuned after major flaws were found

The OpenSSL project has released several patches for moderate flaws, including an additional defense against the Logjam vulnerability revealed last month.

OpenSSL is widely used open-source software that encrypts communications using the SSL/TLS (Secure Sockets Layer/Transport Layer Security) protocol. SSL/TLS prevents clear-text data from being transmitted across the Web, avoiding high security risks.

The patches include three for moderate flaws. Two of these fix flaws that could be used for denial of service attacks, according to an advisory. The third patch fixes a moderate flaw that affects OpenSSL versions prior to a June 2014 release. A fourth patch is for a low severity race condition flaw.

The latest versions of OpenSSL are now 1.0.2b, 1.0.1n, 1.0.0s and 0.9.8zg.

Another change in OpenSSL is an additional defense against the so-called Logjam flaw, which can allow an attacker to significantly weaken the encrypted connection between a user and a Web or email server.

Logjam lies specifically within a set of Diffie-Hellman algorithms, which facilitate the exchange of encryption keys before a connection is secured.

Software products that still support weak 512-bit encryption keys could be tricked into using that weak key, which can be calculated and then used to decrypt traffic.

OpenSSL will now reject handshakes that use Diffie-Hellman parameters shorter than 768 bits, the advisory said. Eventually, the limit will be raised to 1,024 bits.

The discovery of an alarming flaw called Heartbleed in April 2014 prompted a wide examination of OpenSSL, which is used by millions of web sites and email severs. An audit is still ongoing in OpenSSL with the aim of eliminating years-old but unknown flaws.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags patchesOpenSSLsecurity

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments