Show Your Support: Have you heard of Phoronix Premium? It's what complements advertisements on this site for our premium ad-free service. For less than $4 USD per month, you can help support our site while the funds generated allow us to keep doing Linux hardware reviews, performance benchmarking, maintain our community forums, and much more.
SSLv2 "DROWN" Vulnerability Disclosed
DROWN is the name for this new SSLv2 woe and is short for Decrypting RSA using Obsolete and Weakened eNcryption. This is a man-in-the-middle attack against servers running TLS for secure communication. DROWN is officially known as cve-2016-0800 where it's explained as, "A padding oracle flaw was found in the Secure Sockets Layer version 2.0 (SSLv2) protocol. An attacker can potentially use this flaw to decrypt RSA-encrypted cipher text from a connection using a newer SSL/TLS protocol version, allowing them to decrypt such connections. This cross-protocol attack is publicly referred to as DROWN."
DROWNAttack.com was setup to provide more details on this latest high profile, open-source security issue. There are also more details via the Red Hat Security Blog.