RE: CVE-2013-0169

2013-03-04 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Jakob Bohm Sent: Monday, 25 February, 2013 03:07 On 2/25/2013 4:26 AM, Dave Thompson wrote: snip my mistake The attack is against the specific timing differences that occur when directly implementing the RFC suggested countermeasure against

Re: CVE-2013-0169

2013-02-25 Thread Jakob Bohm
On 2/25/2013 4:26 AM, Dave Thompson wrote: From: owner-openssl-us...@openssl.org On Behalf Of Jakob Bohm Sent: Friday, 22 February, 2013 05:06 On 2/21/2013 11:12 AM, Mozes, Rachel wrote: [other reports say issue] affects just The TLS protocol *_1.1 and 1.2_ *and the DTLS protocol 1.0 and

RE: CVE-2013-0169

2013-02-24 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of Jakob Bohm Sent: Friday, 22 February, 2013 05:06 On 2/21/2013 11:12 AM, Mozes, Rachel wrote: [other reports say issue] affects just The TLS protocol *_1.1 and 1.2_ *and the DTLS protocol 1.0 and 1.2, but in the OpenSSL announcements

Re: CVE-2013-0169

2013-02-22 Thread Jakob Bohm
On 2/21/2013 11:12 AM, Mozes, Rachel wrote: Hi all, Recently, OpenSSL Security Advisory sent a message about a new vulnerability which was found and numbered as CVE-2013-0169. This announce advises to all SSL and TLS users to upgrade the OpenSSL version. But from a quick Google search, it