OpenSSL Delivers Patch To Fix Critical Vulnerability

OpenSSL has been updated to address a single ‘high severity’ vulnerability found in OpenSSL 1.0.1 and 1.0.2.

And the good news is that there are no reports of the vulnerability being publicly exploited.

Heartbleed Rerun?

OpenSSL is an open source technology used by many websites and applications to protect customer data. It made the headlines last year following the discovery of the infamous ‘Heartbleed’ bug that could allow an attacker to acquire encryption keys from web servers, and OpenSSL was forced to quickly issue a patch.

But the new vulnerability concerns those users who upgraded to OpenSSL 1.0.1 and 1.0.2 in June.

According to Threatpost, the vulnerability could allow an attacker with an untrusted TLS certificate to be treated as a certificate authority (CA) and spoof another website. This could allow an attacker for example to redirect traffic, set up man-in-the-middle attacks, phishing schemes and other scenarios that compromises encrypted traffic.

“It’s a bad bug, but only affects anyone who installed the release from June,” Rich Salz, a member of the OpenSSL development team was quoted as saying by Threatpost. “The bug was introduced during that update and affected relatively few organisations. “It’s a bad bug, but the impact is low. We haven’t heard any reports of it being used in production.”

Funding Problem?

Vulnerabilities like this tend to cast the collective spotlight on the lack of funding received by developers of widely used open source technologies.

Earlier this year, researchers at SourceDNA found the bug in version 2.5.2 of AFNetworking, a library used by many iOS and Mac OSX developers for networking functions. It was feared that as many as 25,000 iOS apps were vulnerable to man-in-the-middle attacks capable of stealing user data through the use of freely available SSL certificates.

Those vulnerabilities highlight the fact that many open source technologies, whilst widely used, do not receive funding in line with their importance.

Commercial organisations for example tend to have large security teams and they offer “bug bounties” schemes that deliver financial rewards for the discovery of bugs and vulnerabilities in their products.

How well do you know open source software? Take our quiz!