Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.devel.release > #67662

Re: embedding openssl source in sslcan

Cross-posted to 2 groups.

Show all headers | View raw

Hi,

Am 2. Januar 2017 11:35:30 MEZ, schrieb Thijs Kinkhorst <thijs@debian.org>:
>On Fri, December 23, 2016 18:53, Moritz Mühlenhoff wrote:
>> Sebastian Andrzej Siewior <sebastian@breakpoint.cc> schrieb:
>>
>> Please use team@security.debian.org if you want to reach the security
>> team, not debian-security@ldo.
>>
>>> tl;dr: Has anyone a problem if sslscan embeds openssl 1.0.2 in its
>>> source?
>>
>> That's for post-stretch, right? Right now it can simply link against
>> the 1.0.2 copy,
>>
>> Seems fine to me for that use case, and it won't need any security
>> updates to the embedded openssl copy for all practical purposes
>anyway.
>
>I agree, the risk for this use case is quite low,

I don't think that's true: there are already attacks against forensic software out there, and if you have e.g. remote code execution in SSL client code, any usage of sslscan built against an unpatched openssl-insecure would be quite dangerous.

There are other bugs you don't need to care about in this case:
- timing side channels
- most information leaks
- insecure algorithms
- DoS
- weak RNG

But just because the scanner use case isn't affected by these types of bugs doesn't mean you can skip security updates for this altogether. What is true is that the maintenance burden is somewhat lower. (OTOH one needs to be able to judge whether each specific vulnerability affects this or not, which also isn't entirely trivial )

>and having tools like
>sslscan readily available in Debian is greatly beneficial for security.

ACK on this front, I find sslscan very useful myself.

Regards,
Christian

Back to linux.debian.devel.release | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

embedding openssl source in sslcan Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2016-12-22 13:40 +0100
  Re: embedding openssl source in sslcan Moritz Mühlenhoff <jmm@inutil.org> - 2016-12-24 19:10 +0100
    Re: embedding openssl source in sslcan Jonathan Yu <jawnsy@cpan.org> - 2016-12-24 22:20 +0100
    Re: embedding openssl source in sslcan "Thijs Kinkhorst" <thijs@debian.org> - 2017-01-02 11:40 +0100
      Re: embedding openssl source in sslcan Christian Seiler <christian@iwakd.de> - 2017-01-02 17:20 +0100
  Re: embedding openssl source in sslcan Julien Cristau <jcristau@debian.org> - 2016-12-31 17:40 +0100
    Re: embedding openssl source in sslcan Raphael Hertzog <hertzog@debian.org> - 2017-01-01 16:40 +0100
      Re: [Pkg-openssl-devel] embedding openssl source in sslcan Kurt Roeckx <kurt@roeckx.be> - 2017-01-01 17:50 +0100
    Re: embedding openssl source in sslcan Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2017-01-05 21:40 +0100
      Re: embedding openssl source in sslcan Moritz Mühlenhoff <jmm@inutil.org> - 2017-01-05 23:10 +0100

csiph-web