OpenSSL Delivers Patch To Fix Critical Vulnerability

OpenSSL has been updated to address a single ‘high severity’ vulnerability found in OpenSSL 1.0.1 and 1.0.2.

And the good news is that there are no reports of the vulnerability being publicly exploited.

Heartbleed Rerun?

OpenSSL is an open source technology used by many websites and applications to protect customer data. It made the headlines last year following the discovery of the infamous ‘Heartbleed’ bug that could allow an attacker to acquire encryption keys from web servers, and OpenSSL was forced to quickly issue a patch.

But the new vulnerability concerns those users who upgraded to OpenSSL 1.0.1 and 1.0.2 in June.

According to Threatpost, the vulnerability could allow an attacker with an untrusted TLS certificate to be treated as a certificate authority (CA) and spoof another website. This could allow an attacker for example to redirect traffic, set up man-in-the-middle attacks, phishing schemes and other scenarios that compromises encrypted traffic.

“It’s a bad bug, but only affects anyone who installed the release from June,” Rich Salz, a member of the OpenSSL development team was quoted as saying by Threatpost. “The bug was introduced during that update and affected relatively few organisations. “It’s a bad bug, but the impact is low. We haven’t heard any reports of it being used in production.”

Funding Problem?

Vulnerabilities like this tend to cast the collective spotlight on the lack of funding received by developers of widely used open source technologies.

Earlier this year, researchers at SourceDNA found the bug in version 2.5.2 of AFNetworking, a library used by many iOS and Mac OSX developers for networking functions. It was feared that as many as 25,000 iOS apps were vulnerable to man-in-the-middle attacks capable of stealing user data through the use of freely available SSL certificates.

Those vulnerabilities highlight the fact that many open source technologies, whilst widely used, do not receive funding in line with their importance.

Commercial organisations for example tend to have large security teams and they offer “bug bounties” schemes that deliver financial rewards for the discovery of bugs and vulnerabilities in their products.

How well do you know open source software? Take our quiz!

Tom Jowitt

Tom Jowitt is a leading British tech freelancer and long standing contributor to Silicon UK. He is also a bit of a Lord of the Rings nut...

Recent Posts

Google Jarvis AI Extension Leaked On Chrome Store

Seemingly accidental leak reveals Google is developing Jarvis AI extension that can browse the web…

2 days ago

Amazon Mulls New Multi-Billion Dollar Investment In Anthropic – Report

Amazon is reportedly in talks to pump billions of dollars more into AI start-up Anthropic,…

2 days ago

FTX’s Caroline Ellison Begins Her Two Year Prison Sentence

Star witness for the US prosecution of FTX founder Sam Bankman-Fried, has begun her two…

2 days ago

More Layoffs For iRobot Staff After Abandoned Amazon Deal

After axing 31 percent of its workforce when it failed to be acquired by Amazon,…

3 days ago

Mozilla Foundation Confirms Layoffs, Eliminates Advocacy Division

Mozilla Foundation axes 30 percent of its staff, and is eliminating its Advocacy Division that…

3 days ago

Google To Make MFA Mandatory Next Year

Improving security. Mandatory multi-factor authentication (MFA) is coming to the Google Cloud by the end…

3 days ago