From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: OpenSSL CVE-2016-2177, CVE-2016-2178 Date: Sun, 12 Jun 2016 22:49:23 +0200 Message-ID: <87pormi14c.fsf@gnu.org> References: <20160612012201.GA23504@jasmine> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:38877) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bCCK4-000870-Ob for guix-devel@gnu.org; Sun, 12 Jun 2016 16:49:33 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bCCJz-0002ZO-3k for guix-devel@gnu.org; Sun, 12 Jun 2016 16:49:31 -0400 In-Reply-To: <20160612012201.GA23504@jasmine> (Leo Famulari's message of "Sat, 11 Jun 2016 21:22:01 -0400") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: guix-devel@gnu.org Leo Famulari skribis: > Some bugs in OpenSSL were recently disclosed. > > CVE-2016-2177 > http://seclists.org/oss-sec/2016/q2/500 > > CVE-2016-2178 > http://seclists.org/oss-sec/2016/q2/493 > > The second bug can apparently be used by an attacker to recover DSA > keys. And remember that OpenSSH uses OpenSSL, so it is affected too. > > Should we try cherry-picking the upstream commits from the OpenSSL > development repo? Sounds like it. Could you look into it? Thanks for the heads-up! Ludo=E2=80=99.