Number: IRCNE2015032451
Date: 2015/03/18
According to “computerworld”, new versions of OpenSSL will be released on Thursday to patch several security vulnerabilities, one of which is considered highly serious, according to the OpenSSL Project Team.
An advisory published on Monday did not give further details of the vulnerabilities, presumably so as not to tip off hackers and to give some organizations time to add the patch.
The updates will be included in OpenSSL versions 1.0.2a, 1.0.1m, 1.0.0r and 0.9.8zf, the advisory said.
A number of serious problems have been found over the last year in OpenSSL, a widely used open-source software that encrypts communications using the SSL/TLS (Secure Sockets Layer/Transport Layer Security) protocol, a cornerstone of Web security.
OpenSSL has been undergoing a security audit since the Heartbleed flaw was found in April 2014, a serious vulnerability that leaked memory from a server, potentially exposing login credentials, cryptographic keys and other private data.
The software was also affected by FREAK, a flaw revealed earlier this month that can allow an attacker to initiate a weaker type of encrypted connection that can be compromised more easily.
- 6