Honest question: does LibreSSL have this same vulnerability?
If they do, fair comment. If not, then they obviously changed something, ipso facto.
If they do, fair comment. If not, then they obviously changed something, ipso facto.
https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.2.5-...
Update: AAAACHCHC!! Dates! Always the dates. OK, Very well. For your viewing pleasure:
* Americans: Patch was released on 03-17-2021
* Europeans: Patch was released on 17-03-2021
* World inhabitants: Patch was released on 2021-03-17
This is the fix for the OpenSSL issue: https://github.com/openssl/openssl/commit/02b1636fe3db274497...
They don't appear to be related to me. One is a UAF, the other is a NULL pointer dereference.
[1] The LibreSSL issue was found by HAProxy's continuous integration pipeline: https://github.com/haproxy/haproxy/issues/1115. Disclosure: I'm a community contributor of HAProxy, I help maintain the issue tracker and I took part in debugging the issue.