Re: openssl freak

 

On 23/03/2015 14:37, Didier Spaier wrote: 

> On 23/⁠03/⁠2015 02:24, Nick Edwards wrote: 
> 
>> Has Pat gone on holidays?
>> 
>> All our other 3 distros did the urgent openssl updates 3 days ago,
>> even stuffbuntu did it 2 days ago *sigh*
>> 
>> slack is being slack :-⁠>
> 
> Follow the Slackware Security thread on LQ and don't spread FUD.
> 
> Thanks in advance,
> Didier

Openssl did issue an urgent warning saying they underestimated the
severity of freak, and found other critical nasties and released yet
again more patched versions a few days back, so he's hardly spreading
FUD, he's speaking truth. 

unless there is some magical secret NSA proxy cache involved, my
updates, nor my slackware mirrors, have had updates with those new
versions, Pat is not always the fastest with updates of stuff, and in
fact can be weeks after other major distros at times - but with critical
stuff (eg: openssl) he has been just as fast as other distros (eg: RH),
just not this time... perhaps he went away for a well deserved long
weekend of R&R... 

root@mirrors:~# ls
/var/ftp/pub/MIRRORS/slackware/slackware/slackware-13.1/patches/packages/openssl*
/var/ftp/pub/MIRRORS/slackware/slackware/slackware-13.1/patches/packages/openssl-0.9.8zd-i486-1_slack13.1.txt
/var/ftp/pub/MIRRORS/slackware/slackware/slackware-13.1/patches/packages/openssl-0.9.8zd-i486-1_slack13.1.txz
/var/ftp/pub/MIRRORS/slackware/slackware/slackware-13.1/patches/packages/openssl-0.9.8zd-i486-1_slack13.1.txz.asc
/var/ftp/pub/MIRRORS/slackware/slackware/slackware-13.1/patches/packages/openssl-solibs-0.9.8zd-i486-1_slack13.1.txt
/var/ftp/pub/MIRRORS/slackware/slackware/slackware-13.1/patches/packages/openssl-solibs-0.9.8zd-i486-1_slack13.1.txz
/var/ftp/pub/MIRRORS/slackware/slackware/slackware-13.1/patches/packages/openssl-solibs-0.9.8zd-i486-1_slack13.1.txz.asc
root@mirrors:~#

root@mirrors:~# ls
/var/ftp/pub/MIRRORS/slackware/slackware/slackware-14.1/patches/packages/openssl*

/var/ftp/pub/MIRRORS/slackware/slackware/slackware-14.1/patches/packages/openssl-1.0.1k-i486-1_slack14.1.txt
/var/ftp/pub/MIRRORS/slackware/slackware/slackware-14.1/patches/packages/openssl-1.0.1k-i486-1_slack14.1.txz
/var/ftp/pub/MIRRORS/slackware/slackware/slackware-14.1/patches/packages/openssl-1.0.1k-i486-1_slack14.1.txz.asc
/var/ftp/pub/MIRRORS/slackware/slackware/slackware-14.1/patches/packages/openssl-solibs-1.0.1k-i486-1_slack14.1.txt
/var/ftp/pub/MIRRORS/slackware/slackware/slackware-14.1/patches/packages/openssl-solibs-1.0.1k-i486-1_slack14.1.txz
/var/ftp/pub/MIRRORS/slackware/slackware/slackware-14.1/patches/packages/openssl-solibs-1.0.1k-i486-1_slack14.1.txz.asc
root@mirrors:~# 

so no, it aint FUD. 

National Cyber Awareness System: 

OpenSSL Patches Multiple Vulnerabilities [1] 
03/19/2015 12:50 PM EDT 

Original release date: March 19, 2015

OpenSSL has released new updates addressing multiple vulnerabilities,
one of which is classified as a high severity issue. Exploitation could
allow a remote attacker to cause a cause a Denial of Service attack
against the server. 

Updates available include: 

 	* OpenSSL 1.0.2a for 1.0.2 users
 	* OpenSSL 1.0.1m for 1.0.1 users
 	* OpenSSL 1.0.0r for 1.0.0 users
 	* OpenSSL 0.9.8zf for 0.9.8 users

Users and administrators are encouraged to review the OpenSSL Security
Advisory [2] and apply the necessaryupdates [3]. 

 

Links:
------
[1]
https://www.us-cert.gov/ncas/current-activity/2015/03/19/OpenSSL-Patches-Multiple-Vulnerabilities
[2] http://openssl.org/news/secadv_20150319.txt
[3] http://www.openssl.org/news/

_______________________________________________
slackware mailing list
[email protected]
https://mailman.lug.org.uk/mailman/listinfo/slackware