Package: openssl
Version: 3.0.11-1
Recently "The Marvin Attack" aka Bleichenbacher timing attack has been
in the news again:
https://people.redhat.com/~hkario/marvin/
CVE-2022-4304 was already fixed in all but buster:
https://security-tracker.debian.org/tracker/CVE-2022-4304
But the page references an API level pull request upstream:
https://github.com/openssl/openssl/pull/13817
and there is also this corresponding issue:
https://github.com/openssl/openssl/issues/13421
The history on that issue is long and complicated and it's not clear to
me if this has been fixed and if so on what releases? Maybe someone with
more knowledge of this can make more sense of it?
If it hasn't been fixed this bug can track it.
If it has been fixed it would be nice to have something in changelog or
NEWS mentioning it.
But separate from that, it would be good to move away from this old
potentially hazardous method. Is there some way of determining what
software in Debian might be using this (via openssl API) so those things
could get fixed as well?
Not much can be done about non-Debian software running on Debian, but we
want old software to continue to function (at least for a while,
eventually some sort of logged warning might be nice).
Thanks,
--
Matt Taggart
m...@lackof.org
