OpenSSL is an open-source toolkit for encrypted communications, so its vulnerabilities and security updates can affect software, servers, and data protection.
Search across headline titles and summaries.
Background for this topic.
OpenSSL is an open-source cryptographic library and command-line toolkit used to implement Transport Layer Security (TLS), the protocol that protects network connections. It provides cryptographic algorithms, key generation, certificate and X.509 handling, and APIs used by operating systems, servers, applications, and embedded devices. Although commonly associated with “SSL,” the obsolete SSL protocols should not be enabled; modern deployments use TLS.
OpenSSL vulnerabilities can affect many dependent applications, particularly when flaws involve memory handling, cryptographic operations, certificate parsing, or TLS protocol processing. Security teams need an inventory of software and devices that include the library, because updating a package or operating-system component may be necessary even when OpenSSL is not directly visible. Advisories should be assessed against the deployed version, enabled features, and exposure, while private keys require strict protection and certificate validation must be configured correctly. Vulnerability remediation may also require restarting services or replacing processes that continue to use an older library in memory.
Weekly headline count for the current query.
A vulnerability dubbed HollowByte allows unauthenticated attackers to trigger a denial-of-service (DoS) condition on OpenSSL servers with a malicious payload of just 11 bytes. [...]
The OpenSSL Project has patched two high-severity security flaws in its open-source cryptographic library used to encrypt communication channels and HTTPS connections. [...]
American cybersecurity company Palo Alto Networks warned customers on Wednesday that some of its firewall, VPN, and XDR products are vulnerable to a high severity OpenSSL infinite loop bug disclosed three weeks ago [...]
Taiwan-based network-attached storage (NAS) maker QNAP warned on Tuesday that most of its NAS devices are impacted by a high severity OpenSSL bug disclosed two weeks ago. [...]
OpenSSL has released a security update to address a vulnerability in the library that, if exploited, activates an infinite loop function and leads to denial of service conditions. [...]