logo
Apache Lounge
Webmasters

 

About Forum Index Downloads Search Register Log in RSS X


Keep Server Online

If you find the Apache Lounge, the downloads and overall help useful, please express your satisfaction with a donation.

or

Bitcoin

A donation makes a contribution towards the costs, the time and effort that's going in this site and building.

Thank You! Steffen

Your donations will help to keep this site alive and well, and continuing building binaries. Apache Lounge is not sponsored.
Post new topic   Forum Index -> News & Hangout View previous topic :: View next topic
Reply to topic   Topic: OpenSSL 0.98p and OpenSSL 1.00b
Author
nicklowe



Joined: 15 Apr 2007
Posts: 8

PostPosted: Tue 16 Nov '10 22:53    Post subject: OpenSSL 0.98p and OpenSSL 1.00b Reply with quote

http://www.openssl.org/source/

The version shipping with Apache Lounge's build is vulnerable to a nasty security flaw. Isn't apparently exploitable via Apache. But an update is probably advised:

http://openssl.org/news/secadv_20101116.txt

(Is there any reason why the 0.98 branch is shipped rather than 1.00?)

Cheers,

Nick
Back to top
Steffen
Moderator


Joined: 15 Oct 2005
Posts: 3047
Location: Hilversum, NL, EU

PostPosted: Tue 16 Nov '10 23:26    Post subject: Reply with quote

Thanks for letting us know.

Indeed, Apache server is not effected. When I look to the other changes, I see no reason to upgrade now.

We follow the policy of the ASF, so we ship our distro also with 0.98.


Steffen
Back to top
nicklowe



Joined: 15 Apr 2007
Posts: 8

PostPosted: Wed 17 Nov '10 0:22    Post subject: Reply with quote

Interesting. And yet Apache.org uses 1.0.0...

https://www.ssllabs.com/ssldb/analyze.html?d=apache.org

"Apache/2.3.8 (Unix) mod_ssl/2.3.8 OpenSSL/1.0.0a"

Cheers,

Nick
Back to top
Steffen
Moderator


Joined: 15 Oct 2005
Posts: 3047
Location: Hilversum, NL, EU

PostPosted: Wed 17 Nov '10 20:43    Post subject: Reply with quote

ASF ships the Win32 Binary with OpenSSL 0.9.8o (MSI Installer), that we follow in principle.

Steffen
Back to top
Steffen
Moderator


Joined: 15 Oct 2005
Posts: 3047
Location: Hilversum, NL, EU

PostPosted: Tue 30 Nov '10 22:57    Post subject: Reply with quote

OpenSSL 1.0.0b now available at the download page.



Steffen
Back to top
James Blond
Moderator


Joined: 19 Jan 2006
Posts: 7288
Location: Germany, Next to Hamburg

PostPosted: Fri 03 Dec '10 15:46    Post subject: Reply with quote

Would be nice to have that update for 1.0.0c
Back to top


Reply to topic   Topic: OpenSSL 0.98p and OpenSSL 1.00b View previous topic :: View next topic
Post new topic   Forum Index -> News & Hangout