OpenSSL Security Advisory
openssl.org
openssl.org
Otherwise, thanks for sharing this!
It might not be as cool as having an email notification sent by an ifttt recipe executed in the cloud which in turn polls an RSS service regularly which is updated by incoming emails from openssl-announce, but it might just be a tad bit more reliable.
really makes you wonder what else is lurking in openssl when options don't actually do what they say they do. as phk put it, openssl is the crown jewel https://www.youtube.com/watch?v=fwcl17Q0bpk
The 'test' directory of openssl is just a big pile of giant C programs and shell scripts which make up the test cases, and a lot of the features and options are piled together, and there's no documentation. There isn't even an indication of which test case fails when one does fail. I don't see how anyone could get an idea from this of whether a feature works as expected or not, or how many regressions you might have between releases or after new features. As is typical of openssl, it's a big mess.
Am I just stupid or are they not out yet? I guess I've been spoiled by the many embargoed and coordinated releases that was made recently.
That would be an interesting comparison.
My guess is that it doesn't since OpenSSL use a bespoke memory allocator / deallocator which, if I recall correctly, was one of the things that Theo de Raadt was criticising OpenSSL over.
The TLS_FALLBACK_SCSV patch (re POODLE) was ported from BoringSSL (Google's fork of OpenSSL) to address TLS 1.0 downgrading to SSL 3.0. From what I understand, and I might be wrong on this, this is a protocol issue rather than a bug with specific SSL libraries. So LibreSSL might also see a similar TLS_FALLBACK_SCSV patch applied.