Bug 9934

cve-2016-2177 is critical (CVSS 3.0) or High (CVSS2.0)
CVE-2016-2178 is Medium (CVSS 3.0) or low (CVSS 2.0)

so is someone working on this? These will require back porting patches. no new openssl version avaiable

The reason there is no new openssl version is that OpenSSL developers think this is not critical, or even serious:

"This usage could give rise to a low severity security issue in certain unusual scenarios. The OpenSSL security policy (https://www.openssl.org/policies/secpolicy.html) states that we publish low severity issues directly to our public repository, and they get rolled up into the next release whenever that happens."
https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/

No other major distro has issued a security update, so I'd say we shouldn't either.

-

(In reply to comment #2)
> The reason there is no new openssl version is that OpenSSL developers think
> this is not critical, or even serious:

So the Security policy for OE & Yocto is you wont fix "Low" security issues?

This is going to make your CVE checker "WHITELIST" huge.


> 
> "This usage could give rise to a low severity security issue in certain
> unusual scenarios. The OpenSSL security policy
> (https://www.openssl.org/policies/secpolicy.html) states that we publish low
> severity issues directly to our public repository, and they get rolled up
> into the next release whenever that happens."

Yes and so should we. 

> https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/
> 
> No other major distro has issued a security update, so I'd say we shouldn't
> either.

Not yet. They say this might be in the future update.

Will I am planning on sending fixes for both as I believe OpenSource projects have to fix all security issues. The decision to filter is on the commercial OS vendors.

(In reply to comment #4)
> (In reply to comment #2)
> > The reason there is no new openssl version is that OpenSSL developers think
> > this is not critical, or even serious:
> 
> So the Security policy for OE & Yocto is you wont fix "Low" security issues?

That's right. We fix low security issues when upstream releases a new version update that includes them. We don't have resources to do the backporting on systematic basis.

> > https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/
> > 
> > No other major distro has issued a security update, so I'd say we shouldn't
> > either.
> 
> Not yet. They say this might be in the future update.

Link please. Where do the distros say that?

(In reply to comment #5)
> (In reply to comment #4)
> > (In reply to comment #2)
> > > The reason there is no new openssl version is that OpenSSL developers think
> > > this is not critical, or even serious:
> > 
> > So the Security policy for OE & Yocto is you wont fix "Low" security issues?
> 
> That's right. We fix low security issues when upstream releases a new
> version update that includes them.
 We don't have resources to do the
> backporting on systematic basis.

You just made my point regarding the use of the cve-checker.


> 
> > > https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/
> > > 
> > > No other major distro has issued a security update, so I'd say we shouldn't
> > > either.
> > 
> > Not yet. They say this might be in the future update.
> 
> Link please. Where do the distros say that?

https://bugzilla.redhat.com/show_bug.cgi?id=1341705
https://bugzilla.suse.com/show_bug.cgi?id=982575

(In reply to comment #6)

> > Link please. Where do the distros say that?
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=1341705
> https://bugzilla.suse.com/show_bug.cgi?id=982575

Neither link says anything remotely close to "this might be in the future update" or shows any interest in fixing in in the distro before openssl issues a new version. 

You are welcome to continue on the oe-core mailing list.

First of all, these are two different CVEs with a very different cause, so let's keep them separately for future. 

CVE-2016-2177 was confirmed by OpenSSL to be Low risk here: https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/


CVE-2016-2178 - based on paper done by Billy Brumley from Tampere University. Billy has confirmed himself in this thread (http://seclists.org/oss-sec/2016/q2/499 ) that the issue is low severity and only applies to legitimate clients that have access to server. I agree with handling this as "Low" risk. 

So, I think we are in agreement that issues are "Low" risk, so it is up to OE/yocto to treat them with the general policy that they handle Low risk CVEs.