Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5159

Re: embedding openssl source in sslcan

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Given that this would be useful for other tools, perhaps it's best to
create an "openssl-insecure" package which would ship a version of openssl
that has all the bells-and-whistles enabled (including the insecure ones).
We would have to take care that nothing is unintentionally linked to the
library. It would be a useful companion to software like testssl.sh (which
has similar requirements to sslscan)

I certainly don't have strong feelings about this, especially given that I
haven't done any of the work... Just a thought :)

On Fri, Dec 23, 2016 at 9:53 AM, Moritz Mühlenhoff <jmm@inutil.org> wrote:

> Sebastian Andrzej Siewior <sebastian@breakpoint.cc> schrieb:
>
> Please use team@security.debian.org if you want to reach the security
> team, not debian-security@ldo.
>
> > tl;dr: Has anyone a problem if sslscan embeds openssl 1.0.2 in its
> > source?
>
> That's for post-stretch, right? Right now it can simply link against
> the 1.0.2 copy,
>
> Seems fine to me for that use case, and it won't need any security
> updates to the embedded openssl copy for all practical purposes anyway.
>
> Cheers,
>         Moritz
>
>


-- 
Cheers,

Jonathan

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

embedding openssl source in sslcan Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2016-12-22 13:40 +0100
  Re: embedding openssl source in sslcan Moritz Mühlenhoff <jmm@inutil.org> - 2016-12-24 19:10 +0100
    Re: embedding openssl source in sslcan Jonathan Yu <jawnsy@cpan.org> - 2016-12-24 22:20 +0100
      Re: embedding openssl source in sslcan Hans-Christoph Steiner <hans@at.or.at> - 2016-12-26 11:50 +0100
    Re: embedding openssl source in sslcan "Thijs Kinkhorst" <thijs@debian.org> - 2017-01-02 11:40 +0100
      Re: embedding openssl source in sslcan Christian Seiler <christian@iwakd.de> - 2017-01-02 17:20 +0100

csiph-web