OpenSSL Affected By Four More Security Vulnerabilities

[GreatEmerald]

Is it already possible to build a gentoo system with libressl instead of openssl?

I would like that too, just with GnuTLS instead of OpenSSL, but unfortunately Portage insists on OpenSSL at the moment.

[darkbasic]

Yep, I've been running libressl gentoo systems for over 6 months now. Just add libressl overlay and set libressl global useflag. The only notable project that can't be patched easily is the last two major versions of NodeJS, but they also lack support for OpenSSL 0.9.x, but that project also seems to be run by crazy people with 0 interest in stability (pushing two API breaking releases in a month).

Oh and bitcoin.... their devs don't trust libressl on their spaghetti. Need to patch out the check for it and it works fine.

How lucky, I use both node and bitcoin.

[wretched_dutchman]

Is LibreSSL affected?

Yes, they applied the fixes for CVE-2015-319{4,5}. CVE-2015-319{3,6} are not affected: http://marc.info/?l=openbsd-tech&m=144920913324251&w=2

[jason.oliveira]

And there it is.

Does LibreSSL have the occasional heart-stopper that's far quieter or can you run Fort Knox on it?

ignore joecool. it's designed for things like Fort Knox.