Menu
OpenSSL releases several patches but none for serious issues

OpenSSL releases several patches but none for serious issues

The encryption application is still being fine-tuned after major flaws were found

The OpenSSL project has released several patches for moderate flaws, including an additional defense against the Logjam vulnerability revealed last month.

OpenSSL is widely used open-source software that encrypts communications using the SSL/TLS (Secure Sockets Layer/Transport Layer Security) protocol. SSL/TLS prevents clear-text data from being transmitted across the Web, avoiding high security risks.

The patches include three for moderate flaws. Two of these fix flaws that could be used for denial of service attacks, according to an advisory. The third patch fixes a moderate flaw that affects OpenSSL versions prior to a June 2014 release. A fourth patch is for a low severity race condition flaw.

The latest versions of OpenSSL are now 1.0.2b, 1.0.1n, 1.0.0s and 0.9.8zg.

Another change in OpenSSL is an additional defense against the so-called Logjam flaw, which can allow an attacker to significantly weaken the encrypted connection between a user and a Web or email server.

Logjam lies specifically within a set of Diffie-Hellman algorithms, which facilitate the exchange of encryption keys before a connection is secured.

Software products that still support weak 512-bit encryption keys could be tricked into using that weak key, which can be calculated and then used to decrypt traffic.

OpenSSL will now reject handshakes that use Diffie-Hellman parameters shorter than 768 bits, the advisory said. Eventually, the limit will be raised to 1,024 bits.

The discovery of an alarming flaw called Heartbleed in April 2014 prompted a wide examination of OpenSSL, which is used by millions of web sites and email severs. An audit is still ongoing in OpenSSL with the aim of eliminating years-old but unknown flaws.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Subscribe here for up-to-date channel news

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags patchesOpenSSLsecurity

Featured

Slideshows

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

Revealed at a glitzy bash in Sydney at the Ivy Penthouse, the first StorageCraft Partner Awards locally saw the vendor honour its top-performing partners with ASI Solutions, SMBiT Pro, Webroot, ACA Pacific and Soft Solutions New Zealand taking home the top awards. Photos by Maria Stefina.

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards
Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

​Synnex and Lenovo hosted 18 resellers for an action-packed weekend adventure in RotoVegas, taking in white water rafting on the Kaituna River, as well as quad biking and dinner at Stratosfare​, overlooking Lake Rotorua at the top of Mount Ngongotaha​. Photos by Synnex.

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip
Show Comments