OpenSSL Patches Critical Certificate Forgery Bug

Posted by timothy on Thursday July 9, 2015 @03:40AM from the quick-fixes-are-good-fixes dept.

msm1267 writes: The mystery OpenSSL patch released today addresses a critical certificate validation issue where anyone with an untrusted TLS certificate can become a Certificate Authority. While serious, the good news according to the OpenSSL Project is that few downstream organizations have deployed the June update where the bug was introduced. From the linked piece: The vulnerability allows an attacker with an untrusted TLS certificate to be treated as a certificate authority and spoof another website. Attackers can use this scenario to redirect traffic, set up man-in-the-middle attacks, phishing schemes and anything else that compromises supposedly encrypted traffic. [Rich Salz, one of the developers] said there are no reports of public exploits.

1 of 45 comments (clear)

Min score:

Reason:

Sort:

LibreSSL and BoringSSL? by tepples · 2015-07-09 04:43 · Score: 3, Interesting

If you're running any kind of client connection (for instance, consuming a https webservice) then you'll need to update (unless they're using gnutls or nss instead of openssl)
Are LibreSSL and BoringSSL also affected? The article mentions that a BoringSSL contributor found the problem, but it doesn't say one way or the other whether this misbehavior made it into any releases of BoringSSL or any other OpenSSL fork.