The OpenSSL Software Foundation has released new patches for the popular
open-source cryptographic library, but for two of its older branches
they will likely be the last security updates.
This could spell trouble for some enterprise applications that bundle
the 0.9.8 or 1.0.0 versions of OpenSSL and for older systems -- embedded
devices in particular -- where updates are rare.
OpenSSL 1.0.0t and 0.9.8zh, which
were released Thursday, are
expected to be the last updates because support for these these two
branches will end on Dec. 31, as listed in the organization's release
strategy document.
Both the 1.0.0t and 0.9.8zh versions contain a fix for memory leak
vulnerability of moderate severity that can be triggered with malformed
X509_ATTRIBUTE structures. Version 0.9.8zh also fixes a low-impact race
condition when handling PSK identity hints that has previously been
fixed in older 1.0.0, 1.0.1 and 1.0.2 versions.
Versions 1.0.2e and 1.0.1q were also released Thursday, to fix two other
moderate vulnerabilities, one that affects only the 1.0.2 branch and
one that affects both.
Support for the 1.0.1 branch is expected to end on Dec. 31, 2016 and for
the 1.0.2 branch on Dec. 31, 2019. Applications and systems that still
rely on OpenSSL 0.9.8 or 1.0.0 should be updated as soon as possible to
one of these versions, but this might not be easy.
Previous research has shown that many companies using in-house built
software keep poor records of which library versions their developers
used in which of their applications. Such companies might have trouble
identifying where the soon-to-be-unsupported OpenSSL versions are used
in their organizations.
When the critical Heartbleed vulnerability was announced in April 2014,
even large software and hardware vendors took months to identify which
of their products contained vulnerable versions of OpenSSL.
This makes it very likely that some systems and applications with
OpenSSL 0.9.8 and 1.0.0 will never be updated, leaving them exposed to
any critical vulnerabilities found in the library in the future.
Comments
Post a Comment