9934 2016-07-14 08:54:23 +0000 openssl-1.0.2h open CVEs: CVE-2016-2177, CVE-2016-2178 2016-07-29 16:01:55 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core unspecified x86 Multiple RESOLVED WONTFIX Medium+ normal 2.2 M2 1 amarnath.valluri alex.kanavin akuster elena.reshetova jose.perez.carranza meta.mr.watcher meta.watcher patrick.ohly sgw david.israelx.rodriguez.castellanos --- --- No (bug/feature does not impact docs) oldest_to_newest 63965 0 amarnath.valluri 2016-07-14 08:54:23 +0000 OpenSSL v1.02.h has the following open CVEs: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2177 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2178 63988 1 akuster 2016-07-14 15:18:21 +0000 cve-2016-2177 is critical (CVSS 3.0) or High (CVSS2.0) CVE-2016-2178 is Medium (CVSS 3.0) or low (CVSS 2.0) so is someone working on this? These will require back porting patches. no new openssl version avaiable 64037 2 alex.kanavin 2016-07-15 13:21:29 +0000 The reason there is no new openssl version is that OpenSSL developers think this is not critical, or even serious: "This usage could give rise to a low severity security issue in certain unusual scenarios. The OpenSSL security policy (https://www.openssl.org/policies/secpolicy.html) states that we publish low severity issues directly to our public repository, and they get rolled up into the next release whenever that happens." https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/ No other major distro has issued a security update, so I'd say we shouldn't either. 64039 3 alex.kanavin 2016-07-15 13:28:49 +0000 - 64047 4 akuster 2016-07-15 15:15:21 +0000 (In reply to comment #2) > The reason there is no new openssl version is that OpenSSL developers think > this is not critical, or even serious: So the Security policy for OE & Yocto is you wont fix "Low" security issues? This is going to make your CVE checker "WHITELIST" huge. > > "This usage could give rise to a low severity security issue in certain > unusual scenarios. The OpenSSL security policy > (https://www.openssl.org/policies/secpolicy.html) states that we publish low > severity issues directly to our public repository, and they get rolled up > into the next release whenever that happens." Yes and so should we. > https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/ > > No other major distro has issued a security update, so I'd say we shouldn't > either. Not yet. They say this might be in the future update. Will I am planning on sending fixes for both as I believe OpenSource projects have to fix all security issues. The decision to filter is on the commercial OS vendors. 64053 5 alex.kanavin 2016-07-15 16:02:06 +0000 (In reply to comment #4) > (In reply to comment #2) > > The reason there is no new openssl version is that OpenSSL developers think > > this is not critical, or even serious: > > So the Security policy for OE & Yocto is you wont fix "Low" security issues? That's right. We fix low security issues when upstream releases a new version update that includes them. We don't have resources to do the backporting on systematic basis. > > https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/ > > > > No other major distro has issued a security update, so I'd say we shouldn't > > either. > > Not yet. They say this might be in the future update. Link please. Where do the distros say that? 64055 6 akuster 2016-07-15 16:07:48 +0000 (In reply to comment #5) > (In reply to comment #4) > > (In reply to comment #2) > > > The reason there is no new openssl version is that OpenSSL developers think > > > this is not critical, or even serious: > > > > So the Security policy for OE & Yocto is you wont fix "Low" security issues? > > That's right. We fix low security issues when upstream releases a new > version update that includes them. We don't have resources to do the > backporting on systematic basis. You just made my point regarding the use of the cve-checker. > > > > https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/ > > > > > > No other major distro has issued a security update, so I'd say we shouldn't > > > either. > > > > Not yet. They say this might be in the future update. > > Link please. Where do the distros say that? https://bugzilla.redhat.com/show_bug.cgi?id=1341705 https://bugzilla.suse.com/show_bug.cgi?id=982575 64058 7 alex.kanavin 2016-07-15 16:12:46 +0000 (In reply to comment #6) > > Link please. Where do the distros say that? > > https://bugzilla.redhat.com/show_bug.cgi?id=1341705 > https://bugzilla.suse.com/show_bug.cgi?id=982575 Neither link says anything remotely close to "this might be in the future update" or shows any interest in fixing in in the distro before openssl issues a new version. You are welcome to continue on the oe-core mailing list. 64144 8 elena.reshetova 2016-07-19 07:38:42 +0000 First of all, these are two different CVEs with a very different cause, so let's keep them separately for future. CVE-2016-2177 was confirmed by OpenSSL to be Low risk here: https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/ CVE-2016-2178 - based on paper done by Billy Brumley from Tampere University. Billy has confirmed himself in this thread (http://seclists.org/oss-sec/2016/q2/499 ) that the issue is low severity and only applies to legitimate clients that have access to server. I agree with handling this as "Low" risk. So, I think we are in agreement that issues are "Low" risk, so it is up to OE/yocto to treat them with the general policy that they handle Low risk CVEs.