OpenSSL, one of the most widely used encryption libraries in the world, has just released three security updates. These updates cover the two current open-source versions that the organisation supports, as well as the Old 1.0.2-version series, which is only available to customers who pay for premium support. The OpenSSL project used to have four-part version identifiers, with the last letter acting as a counter that could support 26 sub-versions. However, this was not enough, so the team decided to adopt the popular X.Y.Z three-number versioning system. There are eight CVE-numbered bug fixes in total, seven of which were caused by memory mismanagement. These include X.400 address type confusion in X.509 GeneralName, use-after-free following BIO new NDEF, NULL dereference during PKCS7 data verification, and read buffer overflows. The most serious bug is the type confusion bug, which can allow an attacker to pass arbitrary pointers to a memcmp() call, enabling them to read memory contents. To ensure that all related tasks take the same amount of time, even the Easy cases must be slowed down. It is important to remember that, for many Linux distros, an operating system update must be installed for the shared libraries used by many applications, as well as updating any applications that bring along their own versions of OpenSSL.
This Cyber News was published on nakedsecurity.sophos.com. Publication date: Thu, 09 Feb 2023 17:41:02 +0000