OpenSSL has been updated to address a single ‘high severity’ vulnerability found in OpenSSL 1.0.1 and 1.0.2.
And the good news is that there are no reports of the vulnerability being publicly exploited.
But the new vulnerability concerns those users who upgraded to OpenSSL 1.0.1 and 1.0.2 in June.
According to Threatpost, the vulnerability could allow an attacker with an untrusted TLS certificate to be treated as a certificate authority (CA) and spoof another website. This could allow an attacker for example to redirect traffic, set up man-in-the-middle attacks, phishing schemes and other scenarios that compromises encrypted traffic.
“It’s a bad bug, but only affects anyone who installed the release from June,” Rich Salz, a member of the OpenSSL development team was quoted as saying by Threatpost. “The bug was introduced during that update and affected relatively few organisations. “It’s a bad bug, but the impact is low. We haven’t heard any reports of it being used in production.”
Vulnerabilities like this tend to cast the collective spotlight on the lack of funding received by developers of widely used open source technologies.
Earlier this year, researchers at SourceDNA found the bug in version 2.5.2 of AFNetworking, a library used by many iOS and Mac OSX developers for networking functions. It was feared that as many as 25,000 iOS apps were vulnerable to man-in-the-middle attacks capable of stealing user data through the use of freely available SSL certificates.
Those vulnerabilities highlight the fact that many open source technologies, whilst widely used, do not receive funding in line with their importance.
Commercial organisations for example tend to have large security teams and they offer “bug bounties” schemes that deliver financial rewards for the discovery of bugs and vulnerabilities in their products.
How well do you know open source software? Take our quiz!
Seemingly accidental leak reveals Google is developing Jarvis AI extension that can browse the web…
Amazon is reportedly in talks to pump billions of dollars more into AI start-up Anthropic,…
Star witness for the US prosecution of FTX founder Sam Bankman-Fried, has begun her two…
After axing 31 percent of its workforce when it failed to be acquired by Amazon,…
Mozilla Foundation axes 30 percent of its staff, and is eliminating its Advocacy Division that…
Improving security. Mandatory multi-factor authentication (MFA) is coming to the Google Cloud by the end…