Menu
No more security fixes for older OpenSSL branches

No more security fixes for older OpenSSL branches

Support for the 0.9.8 and 1.0.0 branches of OpenSSL will end on Dec. 31

The OpenSSL Software Foundation has released new patches for the popular open-source cryptographic library, but for two of its older branches they will likely be the last security updates.

This could spell trouble for some enterprise applications that bundle the 0.9.8 or 1.0.0 versions of OpenSSL and for older systems -- embedded devices in particular -- where updates are rare.

OpenSSL 1.0.0t and 0.9.8zh, which were released Thursday, are expected to be the last updates because support for these these two branches will end on Dec. 31, as listed in the organization's release strategy document.

Both the 1.0.0t and 0.9.8zh versions contain a fix for memory leak vulnerability of moderate severity that can be triggered with malformed X509_ATTRIBUTE structures. Version 0.9.8zh also fixes a low-impact race condition when handling PSK identity hints that has previously been fixed in older 1.0.0, 1.0.1 and 1.0.2 versions.

Versions 1.0.2e and 1.0.1q were also released Thursday, to fix two other moderate vulnerabilities, one that affects only the 1.0.2 branch and one that affects both.

Support for the 1.0.1 branch is expected to end on Dec. 31, 2016 and for the 1.0.2 branch on Dec. 31, 2019. Applications and systems that still rely on OpenSSL 0.9.8 or 1.0.0 should be updated as soon as possible to one of these versions, but this might not be easy.

Previous research has shown that many companies using in-house built software keep poor records of which library versions their developers used in which of their applications. Such companies might have trouble identifying where the soon-to-be-unsupported OpenSSL versions are used in their organizations.

When the critical Heartbleed vulnerability was announced in April 2014, even large software and hardware vendors took months to identify which of their products contained vulnerable versions of OpenSSL.

This makes it very likely that some systems and applications with OpenSSL 0.9.8 and 1.0.0 will never be updated, leaving them exposed to any critical vulnerabilities found in the library in the future.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise

Ingram Micro completed its nationwide roadshow in Auckland last month, kicking off its Innovation Hour series with Hewlett Packard Enterprise. Uncovering the latest in storage, networking and servers, the event outlined key market trends for resellers in 2016 and beyond.

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise
IN PICTURES: FireEye celebrates channel at 2016 Partner Conference

IN PICTURES: FireEye celebrates channel at 2016 Partner Conference

FireEye welcomed 143 channel partners and distributors to FireEye's 2016 annual Partner Conference, FireEye A/NZ Momentum - held at Establishment in Sydney. Delegates heard from senior trans-Tasman channel leaders, marketing and the product divisions in the morning, with FireEye customers, incident responders and threat intelligence analysts sharing knowledge during the afternoon.

IN PICTURES: FireEye celebrates channel at 2016 Partner Conference
Show Comments