OpenSSL server failure

2011-02-08 Thread Lutz Jaenicke
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi! unfortunately the OpenSSL project has been hit by a hardware defect (hard disk and power supply). The project hence had to be migrated to a different server using a later version of the operating system and tools. Services are currently being

OpenSSL 1.0.0d released

2011-02-08 Thread Bodo Moeller
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 OpenSSL version 1.0.0d released === OpenSSL - The Open Source toolkit for SSL/TLS http://www.openssl.org/ The OpenSSL project team is pleased to announce the release of version 1.0.0d of our open source

OpenSSL Security Advisory: OCSP stapling vulnerability

2011-02-08 Thread Bodo Moeller
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 OpenSSL Security Advisory [8 February 2011] OCSP stapling vulnerability in OpenSSL == Incorrectly formatted ClientHello handshake messages could cause OpenSSL to parse past the end of the message. This issue

OpenSSL Security Advisory: OCSP stapling vulnerability

2011-02-08 Thread Bodo Moeller
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 OpenSSL Security Advisory [8 February 2011] OCSP stapling vulnerability in OpenSSL == Incorrectly formatted ClientHello handshake messages could cause OpenSSL to parse past the end of the message. This issue

OpenSSL 1.0.0d released

2011-02-08 Thread Bodo Moeller
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 OpenSSL version 1.0.0d released === OpenSSL - The Open Source toolkit for SSL/TLS http://www.openssl.org/ The OpenSSL project team is pleased to announce the release of version 1.0.0d of our open source

[openssl.org #2447] possible weakness, encryption password truncation (FreeBSD 8.0; OpenSSL 0.9.8n)

2011-02-08 Thread Alan Hughes via RT
I've attempted to trace through the source code to verify this, but I'm not a C programmer so just ended up in knots. When encrypting using a password it is hashed to give key and IV. It appears and is stated in the docs that the default password hash used is crypt style, which truncates the

Re: OpenSSL 1.0.0d released

2011-02-08 Thread Corinna Vinschen
On Feb 8 18:56, Bodo Moeller wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 OpenSSL version 1.0.0d released === I'm missing an official release mail for 0.9.8r. Will you create one? Thanks, Corinna -- Corinna Vinschen Cygwin Project Co-Leader

Re: OpenSSL 1.0.0d released

2011-02-08 Thread Bodo Moeller
On Tue, Feb 8, 2011 at 7:48 PM, Corinna Vinschen vinsc...@redhat.comwrote: OpenSSL version 1.0.0d released I'm missing an official release mail for 0.9.8r. Will you create one? I wasn't planning to -- http://www.openssl.org/news/secadv_20110208.txt also announces 0.9.8r for those using the

Re: OpenSSL 1.0.0d released

2011-02-08 Thread Corinna Vinschen
On Feb 8 21:22, Bodo Moeller wrote: On Tue, Feb 8, 2011 at 7:48 PM, Corinna Vinschen vinsc...@redhat.comwrote: OpenSSL version 1.0.0d released I'm missing an official release mail for 0.9.8r. Will you create one? I wasn't planning to --

Re: OpenSSL HEAD on UnixWare

2011-02-08 Thread Andy Polyakov
It's been a while since I attempted to build HEAD on my UnixWare 7.1.4 box so I gave it a try. Unfortunately it blows up on crypto/modes/ghash-x86.s cc -I.. -I../.. -I../asn1 -I../evp -I../../include -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -Kthread -DDSO_DLFCN -DHAVE_DLFCN_H

Re: OpenSSL HEAD on UnixWare

2011-02-08 Thread Tim Rice
On Wed, 9 Feb 2011, Andy Polyakov wrote: Hopefully there is a more portable way to do the assembler on ghash-x86.s could you compile following snippet: shor i=5; generate assembler output with cc -S and submit it? a. I'm guessing you mean short i=5; .. .file x.c