Hacker News Reader

Full thread

reaperhulk

Logos are now prerequisite, so of course CVE-2014-0224 has you covered. http://ccsinjection.lepidum.co.jp

If you want to see the patches they're now up on GitHub:

OpenSSL 1.0.1: https://github.com/openssl/openssl/commits/OpenSSL_1_0_1-sta...

OpenSSL 1.0.0: https://github.com/openssl/openssl/commits/OpenSSL_1_0_0-sta...

OpenSSL 0.9.8: https://github.com/openssl/openssl/commits/OpenSSL_0_9_8-sta...

View on HN

"Q. How did you find this bug?

A. This bug was discovered by Masashi Kikuchi of Lepidum. He found this bug while studying safe TLS implementations using a proof assistant system Coq."

So they are starting to find actual bugs with Coq? I'm impressed, and would love to know if anybody has more details (lepidum's blog seems down at the moment).

The ImperialViolet post linked above gives a different URL for the blog post which does work: http://ccsinjection.lepidum.co.jp/blog/2014-06-05/CCS-Inject...

There's some good discussion of it on the netsec subreddit.

http://www.reddit.com/r/netsec/comments/27dhcn/openssl_secur...

Reply on news.ycombinator.com