Hacker News Reader

Comment by gbrown_ | Hacker News Reader

We all do. What distros is this affecting though? It seems like this is only in "recent" versions.

Aren't these the currently maintained versions? Anying pre-1.0.1 is no longer being maintained, and they note 1.0.1 will be going away soon too.

Quite right! I missed that bit.

    Note
    ====
    
    Support for version 1.0.1 ended on 31st December 2016. Support for versions
    0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer
    receiving security updates.

It's not clear whether the first CVE (crash via OOB read) affects 1.0.1.

The OpenSSL team may not be maintaining them but some distros are.

Reply on news.ycombinator.com