RE: CVE-2013-0169

2013-03-04 Thread Dave Thompson
> From: owner-openssl-us...@openssl.org On Behalf Of Jakob Bohm > Sent: Monday, 25 February, 2013 03:07 > On 2/25/2013 4:26 AM, Dave Thompson wrote: > The attack is against the specific timing differences that occur when > directly implementing the RFC suggested countermeasure against the > much

Re: CVE-2013-0169

2013-02-25 Thread Jakob Bohm
On 2/25/2013 4:26 AM, Dave Thompson wrote: From: owner-openssl-us...@openssl.org On Behalf Of Jakob Bohm Sent: Friday, 22 February, 2013 05:06 On 2/21/2013 11:12 AM, Mozes, Rachel wrote: [other reports say issue] affects just "The TLS protocol *_1.1 and 1.2_ *and the DTLS protocol 1.0 and

RE: CVE-2013-0169

2013-02-24 Thread Dave Thompson
> From: owner-openssl-us...@openssl.org On Behalf Of Jakob Bohm > Sent: Friday, 22 February, 2013 05:06 > On 2/21/2013 11:12 AM, Mozes, Rachel wrote: [other reports say issue] > > affects just "The TLS protocol *_1.1 and 1.2_ *and the DTLS > protocol 1.0 > > and 1.2", but in the OpenSSL announce

Re: CVE-2013-0169

2013-02-22 Thread Jakob Bohm
On 2/21/2013 11:12 AM, Mozes, Rachel wrote: Hi all, Recently, OpenSSL Security Advisory sent a message about a new vulnerability which was found and numbered as CVE-2013-0169. This announce advises to all SSL and TLS users to upgrade the OpenSSL version. But from a quick Google search, it loo