OpenSSL 1.0.2 ClientHello Sigalgs DoS (CVE-2015-0291)

openssl.org

17 pointsburo96 comments

Wasn't loading for me: http://pastebin.com/raw.php?i=Qq6SFiDF

changelog: http://pastebin.com/raw.php?i=zeuMLdS1

Your comment on the other thread is dead because it's a dupe of this one. Delete that one, and make a new comment with slightly different text.

.. really? Someone else already linked a mirror so I don't need to bother, but I never would have known if you didn't tell me.

That seems like a bit of an over-zealous heuristic for spam. Also, it seems silly to have two different threads just because one URL has https in the first place.

> Also, it seems silly to have two different threads just because one URL has https in the first place.

They're both https, but the reason for the duplication is equally as dumb: this one doesn't have a www sub-domain where as the other one does.

Yeah, it's even labeled [dupe]. I don't think it's for spam, it's just for double-posting.

The commit that fixes CVE-2015-0291: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h...

Reply on news.ycombinator.com