|
|
Log in / Subscribe / Register

OpenSSL 1.0.0 released

OpenSSL 1.0.0 released

Posted Mar 30, 2010 13:49 UTC (Tue) by jbardin (guest, #54917)
In reply to: OpenSSL 1.0.0 released by dlang
Parent article: OpenSSL 1.0.0 released

A real bug only as reported by valgrind. OpenSSH was purposely using a chunk of unallocated memory as part of its source of entropy.

to post comments

OpenSSL 1.0.0 released

Posted Mar 30, 2010 14:36 UTC (Tue) by mpr22 (subscriber, #60784) [Link]

To my mind, if it didn't have a suitably forceful comment attached to it, it was a bug even if it was deliberate. ("Yes, we really do mean to use uninitialized memory as an entropy source. Yes, we know code validation tools will whine about it.")

OpenSSL 1.0.0 released

Posted Mar 30, 2010 16:53 UTC (Tue) by vonbrand (guest, #4458) [Link]

"Uninitialized memory" != "random contents". This was not a valid entropy source.


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds