Hacker News Reader

Good question. I found this, release 17-03-2021, that seems to be the same bug. So yes, they had the same vulnerability.

https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.2.5-...

Update: AAAACHCHC!! Dates! Always the dates. OK, Very well. For your viewing pleasure:

* Americans: Patch was released on 03-17-2021

* Europeans: Patch was released on 17-03-2021

* World inhabitants: Patch was released on 2021-03-17

View on HN

This is the fix for the LibreSSL issue [1]: https://github.com/libressl-portable/openbsd/commit/5f00b800...

This is the fix for the OpenSSL issue: https://github.com/openssl/openssl/commit/02b1636fe3db274497...

They don't appear to be related to me. One is a UAF, the other is a NULL pointer dereference.

[1] The LibreSSL issue was found by HAProxy's continuous integration pipeline: https://github.com/haproxy/haproxy/issues/1115. Disclosure: I'm a community contributor of HAProxy, I help maintain the issue tracker and I took part in debugging the issue.

Reply on news.ycombinator.com