Does anyone know if we need to rebuild openssh with the new openssl
libraries due to this security flaw?
--Kevin
-----Original Message-----
From: Jim Knoble [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, April 24, 2001 12:40 PM
To: [EMAIL PROTECTED]
Subject: OpenSSL-0.9.6a has security fixes
This doesn't seem to have been announced here: OpenSSL-0.9.6a appears
to have been released somewhat quietly, and also appears to include
several security fixes:
- Security fix: change behavior of OpenSSL to avoid using environment
variables when running as root.
- Security fix: check the result of RSA-CRT to reduce the possibility
of deducing the private key from an incorrectly calculated signature.
- Security fix: prevent Bleichenbacher's DSA attack.
- Security fix: Zero the premaster secret after deriving the master
secret in DH ciphersuites.
Also:
We consider OpenSSL 0.9.6a to be the best version of OpenSSL
available and we strongly recommend that users of older versions,
especially of old SSLeay versions, upgrade as soon as possible.
Complete text of the announcement available at:
http://www.openssl.org/news/announce.html
--
jim knoble | [EMAIL PROTECTED] | http://www.jmknoble.cx/
(GnuPG fingerprint: 31C4:8AAC:F24E:A70C:4000::BBF4:289F:EAA8:1381:1491)
