logoon  windows
Apache Lounge
Webmasters

 


About

Forum Index Downloads Search Forum Register Log in  RSS Apache Lounge


Keep Server Online

If you find the Apache Lounge, the downloads and overall help useful, please express your satisfaction with a donation.

or

Bitcoin

A donation makes a contribution towards the costs, the time and effort that's going in this site and building.

Thank You! Steffen

Apache Lounge is not sponsored by anyone.

Your donations will help to keep this site alive and well, and continuing the building of the binaries.




OpenSSL 0.98p and OpenSSL 1.00b

 
Post new topic   Reply to topic    Apache Forum Index -> News & Hangout



View previous topic :: View next topic  
Author Message
nicklowe



Joined: 15 Apr 2007
Posts: 6

PostPosted: Tue 16 Nov '10 22:53    Post subject: OpenSSL 0.98p and OpenSSL 1.00b Reply with quote

http://www.openssl.org/source/

The version shipping with Apache Lounge's build is vulnerable to a nasty security flaw. Isn't apparently exploitable via Apache. But an update is probably advised:

http://openssl.org/news/secadv_20101116.txt

(Is there any reason why the 0.98 branch is shipped rather than 1.00?)

Cheers,

Nick
Back to top
Steffen
Moderator


Joined: 15 Oct 2005
Posts: 2122
Location: Hilversum, NL, EU

PostPosted: Tue 16 Nov '10 23:26    Post subject: Reply with quote

Thanks for letting us know.

Indeed, Apache server is not effected. When I look to the other changes, I see no reason to upgrade now.

We follow the policy of the ASF, so we ship our distro also with 0.98.


Steffen
Back to top
nicklowe



Joined: 15 Apr 2007
Posts: 6

PostPosted: Wed 17 Nov '10 0:22    Post subject: Reply with quote

Interesting. And yet Apache.org uses 1.0.0...

https://www.ssllabs.com/ssldb/analyze.html?d=apache.org

"Apache/2.3.8 (Unix) mod_ssl/2.3.8 OpenSSL/1.0.0a"

Cheers,

Nick
Back to top
Steffen
Moderator


Joined: 15 Oct 2005
Posts: 2122
Location: Hilversum, NL, EU

PostPosted: Wed 17 Nov '10 20:43    Post subject: Reply with quote

ASF ships the Win32 Binary with OpenSSL 0.9.8o (MSI Installer), that we follow in principle.

Steffen
Back to top
Steffen
Moderator


Joined: 15 Oct 2005
Posts: 2122
Location: Hilversum, NL, EU

PostPosted: Tue 30 Nov '10 22:57    Post subject: Reply with quote

OpenSSL 1.0.0b now available at the download page.



Steffen
Back to top
James Blond
Moderator


Joined: 19 Jan 2006
Posts: 4880
Location: Germany, Next to Hamburg

PostPosted: Fri 03 Dec '10 15:46    Post subject: Reply with quote

Would be nice to have that update for 1.0.0c
Back to top


Post new topic   Reply to topic    Apache Forum Index -> News & Hangout
Page 1 of 1