Share news article

Share on facebook
Share on twitter
Share on linkedin
Share on email

OpenSSL to Release Security Patch for Remote Memory Corruption Vulnerability

The latest version of the OpenSSL library has been discovered as susceptible to a remote memory-corruption vulnerability on select systems.

The issue has been identified in OpenSSL version 3.0.4, which was released on June 21, 2022, and impacts x64 systems with the AVX-512 instruction set. OpenSSL 1.1.1 as well as OpenSSL forks BoringSSL and LibreSSL are not affected.

Security researcher Guido Vranken, who reported the bug at the end of May, said it “can be triggered trivially by an attacker.” Although the shortcoming has been fixed, no patches have been made available as yet.

OpenSSL is a popular cryptography library that offers an open source implementation of the Transport Layer Security (TLS) protocol. Advanced Vector Extensions (AVX) are extensions to the x86 instruction set architecture for microprocessors from Intel and AMD.

“I do not think this is a security vulnerability,” Tomáš Mráz of the OpenSSL Foundation said in a GitHub issue thread. “It is just a serious bug making the 3.0.4 release unusable on AVX-512 capable machines.”

On the other hand, Alex Gaynor pointed out, “I’m not sure I understand how it’s not a security vulnerability. It’s a heap buffer overflow that’s triggerable by things like RSA signatures, which can easily happen in remote contexts (e.g. a TLS handshake).”

Xi Ruoyao, a postgraduate student at Xidian University, chimed in, stating that although “I think we shouldn’t mark a bug as ‘security vulnerability’ unless we have some evidence showing it can (or at least, may) be exploited,” it’s necessary to release version 3.0.5 as soon as possible given the severity of the issue.

Found this article interesting? Follow THN on Facebook, Twitter and LinkedIn to read more exclusive content we post.

Related News

CyberSecure Announces Strategic Alliance

CyberSecure Announces Strategic Alliance

BETHESDA, Md., March 24, 2023 /PRNewswire/ — Cybersecure IPS and LockDown Inc. jointly announce that they have entered a strategic alliance to…
Tesla Model 3 Hacked in Less Than 2 Minutes at Pwn2Own Contest

Tesla Model 3 Hacked in Less Than 2 Minutes at Pwn2Own Contest

Researchers from France-based pen-testing firm Synacktiv demonstrated two separate exploits against the Tesla Model 3 this week at the Pwn2Own…
GitHub's Private RSA SSH Key Mistakenly Exposed in Public Repository

GitHub's Private RSA SSH Key Mistakenly Exposed in Public Repository

GitHub, a Microsoft subsidiary has replaced its SSH keys after someone inadvertently published its private RSA SSH host key part of…