Re: bug in Lynx' SSL certificate validation -> leaks password in clear text via SNI (under some circumstances)

2021-08-14 Thread Carlo Strub
Thanks a lot for your email. I added a vuxml entry to inform users. Best, Carlo On Sat, 7 Aug 2021 at 17:07, Katherine Mcmillan wrote: > FYI > > > From: Lynx-dev on > behalf of Ariadne Conill > Sent: 07 August 2021 10:17 > To: oss-secur...@lists.openwall.com

Re: Odd ssh sessions

2020-06-12 Thread Carlo Strub
Can you elaborate on what steps you are doing to get to such a state? On Fri, 5 Jun 2020, 20:48 Lucas Nali de Magalhães, wrote: > > On Jun 5, 2020, at 3:45 PM, Lucas Nali de Magalhães < > rollingb...@gmail.com> wrote: > > > > I've an old machine where I play with FreeBSD and after a while off,

Re: deprecating old ciphers from OpenCrypto...

2014-09-06 Thread Carlo Strub
06/09/2014 00:26 - John-Mark Gurney wrote: As I've been working on OpenCrypto, I've noticed that we have some ciphers that OpenBSD does not... As we haven't had a maintainer for the code, no one has been evaluating which ciphers should be included... I would like to document the following

Re: FreeBSD Security Advisory FreeBSD-SA-14:06.openssl

2014-04-10 Thread Carlo Strub
SSH is not affected. SSH is indeed not affected, but I guess you should still consider the secret sshd key on your otherwise affected server as burnt, as it might have been in the memory too while an attacker was inspecting it via heartbleed. Better recreate the secret ssh key and all

Re: FreeBSD Security Advisory FreeBSD-SA-14:06.openssl

2014-04-10 Thread Carlo Strub
10/04/2014 12:58 - Cyrus Lopez wrote: SSH is not affected. SSH is indeed not affected, but I guess you should still consider the secret sshd key on your otherwise affected server as burnt, as it might have been in the memory too while an attacker was inspecting it via

Re: OpenSSL on 8.3 (pfsense appliance)

2014-04-08 Thread Carlo Strub
it includes the latest patches of openssl. -- Carlo Strub Ports committer ___ freebsd-security@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to freebsd-security-unsubscr...@freebsd.org

Re: OpenPAM/SSHD privacy hole (FreeBSD 9.2+ affected)

2013-10-23 Thread Carlo Strub
23/10/2013 13:56 - Andrei wrote: Hello, I found that in the new FreeBSD 9.2 (probably in 10 also) updated OpenPAM sources. The big embarrassment was in pam_get_authtok.c. The problem is that even without a valid SSH login it's possible to know the server's hostname. az@az:/home/az %