Security Advisories - Revision history

Matt at 17:58, 8 June 2014

2014-06-08T17:58:04Z

Tjh at 19:20, 6 June 2014

2014-06-06T19:20:39Z

Jwalton: Added OSS Security mailing list for advanced notice to vendors.

2014-06-06T03:41:14Z

Added OSS Security mailing list for advanced notice to vendors.

Tjh: correct linked page name

2014-06-05T23:29:37Z

correct linked page name

Tjh at 23:20, 5 June 2014

2014-06-05T23:20:59Z

Tjh at 23:19, 5 June 2014

2014-06-05T23:19:52Z

Tjh at 10:13, 30 April 2014

2014-04-30T10:13:37Z

Tjh: Page of references to additional information related to a security advisory

2014-04-27T02:01:06Z

Page of references to additional information related to a security advisory

New page

= Security Advisories =

When serious security problems in OpenSSL are discovered and corrected, the OpenSSL project issues a security advisory, describing the problem and containing a pointer to the fix.

These are announced to the [http://www.mail-archive.com/openssl-announce@openssl.org/ openssl-announce] mailing list and generally also copied to the [http://www.mail-archive.com/openssl-users@openssl.org/ openssl-users] and [http://www.mail-archive.com/openssl-dev@openssl.org/ openssl-dev] mailing lists and noted in the official [https://www.openssl.org/news/vulnerabilities.html OpenSSL Vulnerabilities List].

If you think your have discovered a problem that has security implications then send details to [mailto:openssl-security@openssl.org openssl-security@openssl.org]

The list below contains references where there is additional information on an issue which may assist OpenSSL users in understanding or responding to an issue.

{| class="wikitable sortable" border="1"
|+ OpenSSL Security Advisories Additional Information
|-
! scope="col" | Date
! scope="col" | Advisory
! scope="col" | Description
! scope="col" | CVE
! scope="col" | Affected Versions
! scope="col" | Fixed In Versions
! scope="col" class="unsortable" | Additional Information
|-
| 07-Apr-2014
| [https://www.openssl.org/news/secadv_20140407.txt SECADV_20140477]
| TLS heartbeat read overrun
| [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160 CVE-2014-1060]
| OpenSSL-1.0.1a to OpenSSL-1.0.1f
OpenSSL-1.0.2 betas
| OpenSSL-1.0.1g
OpenSSL-1.0.2-beta2
| [[SECADV_2014047]]
|-
|-
|}

← Older revision		Revision as of 17:58, 8 June 2014
Line 2:		Line 2:

	These are announced to the [http://www.mail-archive.com/openssl-announce@openssl.org/ openssl-announce] mailing list and generally also copied to the [http://www.mail-archive.com/openssl-users@openssl.org/ openssl-users] and [http://www.mail-archive.com/openssl-dev@openssl.org/ openssl-dev] mailing lists and noted in the official [https://www.openssl.org/news/vulnerabilities.html OpenSSL Vulnerabilities List].		These are announced to the [http://www.mail-archive.com/openssl-announce@openssl.org/ openssl-announce] mailing list and generally also copied to the [http://www.mail-archive.com/openssl-users@openssl.org/ openssl-users] and [http://www.mail-archive.com/openssl-dev@openssl.org/ openssl-dev] mailing lists and noted in the official [https://www.openssl.org/news/vulnerabilities.html OpenSSL Vulnerabilities List].
−
−	If you would like advanced notice of vulnerabilities before they are released to the general public, then please join [http://oss-security.openwall.org/wiki/mailing-lists/distros Operating system distribution security contact lists] at OpenWall's OSS Security.

	If you think your have discovered a problem that has security implications then send details to [mailto:openssl-security@openssl.org openssl-security@openssl.org]		If you think your have discovered a problem that has security implications then send details to [mailto:openssl-security@openssl.org openssl-security@openssl.org]

@@ Line 24: / Line 24: @@
 | SSL/TLS MITM vulnerability (and others)
 | [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224 CVE-2014-0224]
-| OpenSSL-0.9.8a-z, OpenSSL-1.0.0a-l, OpenSSL-1.0.1a-g
+| OpenSSL-0.9.8a-y, OpenSSL-1.0.0a-l, OpenSSL-1.0.1a-g
 | OpenSSL-0.9.8za, OpenSSL-1.0.0m, OpenSSL-1.0.1h
 | [[SECADV_20140605]]

← Older revision		Revision as of 03:41, 6 June 2014
Line 2:		Line 2:

	These are announced to the [http://www.mail-archive.com/openssl-announce@openssl.org/ openssl-announce] mailing list and generally also copied to the [http://www.mail-archive.com/openssl-users@openssl.org/ openssl-users] and [http://www.mail-archive.com/openssl-dev@openssl.org/ openssl-dev] mailing lists and noted in the official [https://www.openssl.org/news/vulnerabilities.html OpenSSL Vulnerabilities List].		These are announced to the [http://www.mail-archive.com/openssl-announce@openssl.org/ openssl-announce] mailing list and generally also copied to the [http://www.mail-archive.com/openssl-users@openssl.org/ openssl-users] and [http://www.mail-archive.com/openssl-dev@openssl.org/ openssl-dev] mailing lists and noted in the official [https://www.openssl.org/news/vulnerabilities.html OpenSSL Vulnerabilities List].
		+
		+	If you would like advanced notice of vulnerabilities before they are released to the general public, then please join [http://oss-security.openwall.org/wiki/mailing-lists/distros Operating system distribution security contact lists] at OpenWall's OSS Security.

	If you think your have discovered a problem that has security implications then send details to [mailto:openssl-security@openssl.org openssl-security@openssl.org]		If you think your have discovered a problem that has security implications then send details to [mailto:openssl-security@openssl.org openssl-security@openssl.org]

@@ Line 19: / Line 19: @@
 |-
 | 05-Jun-2014
-| [https://www.openssl.org/news/secadv_20140605.txt SECADV_201400605]
+| [https://www.openssl.org/news/secadv_20140605.txt SECADV_20140605]
 | SSL/TLS MITM vulnerability (and others)
 | [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224 CVE-2014-0224]
@@ Line 28: / Line 28: @@
 |-
 | 07-Apr-2014
-| [https://www.openssl.org/news/secadv_20140407.txt SECADV_20140477]
+| [https://www.openssl.org/news/secadv_20140407.txt SECADV_20140407]
 | TLS heartbeat read overrun
 | [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160 CVE-2014-1060]

← Older revision		Revision as of 10:13, 30 April 2014
Line 1:		Line 1:
−	~~= Security Advisories =~~
−
	When serious security problems in OpenSSL are discovered and corrected, the OpenSSL project issues a security advisory, describing the problem and containing a pointer to the fix.		When serious security problems in OpenSSL are discovered and corrected, the OpenSSL project issues a security advisory, describing the problem and containing a pointer to the fix.

@@ Line 35: / Line 35: @@
 | OpenSSL-1.0.1g
 OpenSSL-1.0.2-beta2
-| [[SECADV_2014047]]
+| [[SECADV_20140407]]
 |-
 |-
 |}

@@ Line 17: / Line 17: @@
 ! scope="col" | Fixed In Versions
 ! scope="col" class="unsortable" | Additional Information
 |-
 | 07-Apr-2014