OpenSSL Security Advisory - CVE-2014-3508

Hi, Please can I enquire what the actual vulnerability is with... Information leak in pretty printing functions (CVE-2014-3508) = A flaw in OBJ_obj2txt may cause pretty printing functions such as X509_name_oneline,

Disabling Client Initiated renegotiation in 0.9.8

Hi, Following my previous question, is it possible on OpenSSL 0.9.8 to have secure renegotiation but turn off client initiated renegotiation. If so, how? If not, is it available in later versions of OpenSSL? The customer has scanned the phone and the scanner has reported a security problem with

RE: Disabling Secure Renegotiation in 0.9.8

Thanks Dave for the information. I can confirm the customer wants renegotiation turned off altogether. No secure renegotiation and no unsafe renegotiation either. If what they actually want is to drop the secure renegotiation functionality and go back to the old world with traditional unsafe

Is ordering of distinguished names for subject and issuer in OpenSSl 0.9.8 certificates important?

Dear All, I am working on an embedded product which has the OpenSSL 0.9.8w library and acts as a client. It is communicating with another product which has the OpenSSL 0.9.8e library and acts as a server. A customer has supplied the client certificate for the server and the associated root CA

ECC and OpenSSL version

Dear all, I am working on an embedded product which currently uses OpenSSL 0.9.8w with FIPS support. We have received a request to support ECC and in particular the following cipher suites for ECC certification TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA and TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA. I

RE: ECC and OpenSSL version

and OpenSSL version On Tue, May 22, 2012, Simner, John wrote: Dear all, I am working on an embedded product which currently uses OpenSSL 0.9.8w with FIPS support. We have received a request to support ECC and in particular the following cipher suites for ECC certification

Openssl 0.9.8q with appWeb 3.3.0 clear SSL_OP_LEGACY_SERVER_CONNECT

Hello, I am using the openSSL 0.9.8q library in conjunction with appWeb 3.3.0 and I need to remove the TLS renegotiation due to SSL_OP_LEGACY_SERVER_CONNECT being set by default. Is there any way that I can do this as part of building the openSSL 0.9.8q library with ./configure or should I

Openssl 0.9.8q with appWeb 3.3.0 clear SSL_OP_LEGACY_SERVER_CONNECT

HI, I am using the openSSL 0.9.8q library inconjunction with appWeb 3.3.0 and I need to remove the TLS renegotiation due to SSL_OP_LEGACY_SERVER_CONNECT being set by default. Is there any way that I can do this as part of building the openSSL 0.9.8q library with ./configure or should I patch