On Fri, Sep 20, 2002 at 11:07:18AM +0100, [EMAIL PROTECTED] wrote:
> The previous openssl errata at
> http://rhn.redhat.com/errata/RHSA-2002-160.html has no mention of the buffer
> overflows fixed on July 30th. This package was built on August 1st, so it is
> unlikely to include the 0.9.6d patches due to the time lag of testing
> patches by Red Hat.
I cannot give you a definite statement about what I don't know, but I can
participate in speculating :-)
Redhat as well as other system builders have been informed well in advance
about the vulnerabilities including patches to fix them, such that tests
could be performed and updates be prepared. It was our intention that
updated binary packages could be made available more or less in parallel
to our announcement and source code release.
That does not mean, that the fix is actually in. I simply don't know.
Best regard,
Lutz
PS. OpenSSl team member Mark Cox is actually working for Redhat...
--
Lutz Jaenicke [EMAIL PROTECTED]
http://www.aet.TU-Cottbus.DE/personen/jaenicke/
BTU Cottbus, Allgemeine Elektrotechnik
Universitaetsplatz 3-4, D-03044 Cottbus
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
