Menu
No more security fixes for older OpenSSL branches

No more security fixes for older OpenSSL branches

Support for the 0.9.8 and 1.0.0 branches of OpenSSL will end on Dec. 31

The OpenSSL Software Foundation has released new patches for the popular open-source cryptographic library, but for two of its older branches they will likely be the last security updates.

This could spell trouble for some enterprise applications that bundle the 0.9.8 or 1.0.0 versions of OpenSSL and for older systems -- embedded devices in particular -- where updates are rare.

OpenSSL 1.0.0t and 0.9.8zh, which were released Thursday, are expected to be the last updates because support for these these two branches will end on Dec. 31, as listed in the organization's release strategy document.

Both the 1.0.0t and 0.9.8zh versions contain a fix for memory leak vulnerability of moderate severity that can be triggered with malformed X509_ATTRIBUTE structures. Version 0.9.8zh also fixes a low-impact race condition when handling PSK identity hints that has previously been fixed in older 1.0.0, 1.0.1 and 1.0.2 versions.

Versions 1.0.2e and 1.0.1q were also released Thursday, to fix two other moderate vulnerabilities, one that affects only the 1.0.2 branch and one that affects both.

Support for the 1.0.1 branch is expected to end on Dec. 31, 2016 and for the 1.0.2 branch on Dec. 31, 2019. Applications and systems that still rely on OpenSSL 0.9.8 or 1.0.0 should be updated as soon as possible to one of these versions, but this might not be easy.

Previous research has shown that many companies using in-house built software keep poor records of which library versions their developers used in which of their applications. Such companies might have trouble identifying where the soon-to-be-unsupported OpenSSL versions are used in their organizations.

When the critical Heartbleed vulnerability was announced in April 2014, even large software and hardware vendors took months to identify which of their products contained vulnerable versions of OpenSSL.

This makes it very likely that some systems and applications with OpenSSL 0.9.8 and 1.0.0 will never be updated, leaving them exposed to any critical vulnerabilities found in the library in the future.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Events

Featured

Slideshows

Channel kicks 2021 into gear as After Hours returns to Auckland

Channel kicks 2021 into gear as After Hours returns to Auckland

After Hours made a welcome return to the channel social calendar with a bumper crowd of partners, distributors and vendors descending on The Pantry at Park Hyatt in Auckland to kick-start 2021.

Channel kicks 2021 into gear as After Hours returns to Auckland
The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

Hundreds of leaders from the New Zealand IT industry gathered at the Hilton in Auckland on 17 November to celebrate the finest female talent in the Kiwi channel and recognise the winners of the Reseller News Women in ICT Awards (WIICTA) 2020.

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards
Show Comments