From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: OpenSSL CVE-2016-2177, CVE-2016-2178 Date: Sat, 11 Jun 2016 21:22:01 -0400 Message-ID: <20160612012201.GA23504@jasmine> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:40173) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bBu6V-0004nB-Lo for guix-devel@gnu.org; Sat, 11 Jun 2016 21:22:20 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bBu6P-0006B7-OZ for guix-devel@gnu.org; Sat, 11 Jun 2016 21:22:18 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:43138) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bBu6N-0006Ad-FB for guix-devel@gnu.org; Sat, 11 Jun 2016 21:22:13 -0400 Received: from localhost (unknown [65.210.89.2]) by mail.messagingengine.com (Postfix) with ESMTPA id 30A19CCD3A for ; Sat, 11 Jun 2016 21:22:02 -0400 (EDT) Content-Disposition: inline List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org Some bugs in OpenSSL were recently disclosed. CVE-2016-2177 http://seclists.org/oss-sec/2016/q2/500 CVE-2016-2178 http://seclists.org/oss-sec/2016/q2/493 The second bug can apparently be used by an attacker to recover DSA keys. And remember that OpenSSH uses OpenSSL, so it is affected too. Should we try cherry-picking the upstream commits from the OpenSSL development repo?