Hacker News Reader

Full thread

some_furry

If the fix is already committed for any of the vulnerabilities, then the answer is a simple github search away:

https://github.com/openssl/openssl/compare/OpenSSL_1_0_1l......

https://github.com/openssl/openssl/compare/OpenSSL_1_0_2...O...

Some interesting commits:

https://github.com/openssl/openssl/commit/327de270d583e716bc...

https://github.com/openssl/openssl/commit/f5ee5213073870493a...

https://github.com/openssl/openssl/commit/51527f1e3564f210e9...

View on HN

It is weird, two of them (CVE-2015-0288 and CVE-2015-0209) are listed here also with links to patches, https://security-tracker.debian.org/tracker/source-package/o... Why have embargo on the vulnerabilities if you publish patches anyway? Which makes me think that the patches has not been committed yet and that the embargoed are different ones than these.

I found an OpenSSL bug that was assigned CVE-2015-0208 and it is still embargoed near as I can tell.

Reply on news.ycombinator.com