Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Need new Windows build. Last uses openssl lib 1.0.1t which is vulnerable and is 32-bit only. #6

Closed
aaashes opened this issue Aug 3, 2017 · 4 comments
Assignees
Labels

Comments

@aaashes
Copy link

aaashes commented Aug 3, 2017

Few info disclosures, overflows and DoS (boring...), see https://www.cvedetails.com/vulnerability-list/vendor_id-217/product_id-383/version_id-202288/Openssl-Openssl-1.0.1t.html, consider moving to 1.1.0f.
We should also consider pushing out new PEs for both 32 and 64 over the weekend, with the second taking precedence over first.

@EmberCoin
Copy link
Owner

I am setting up building from LibreSSL version 2.5.5.
I do not like OpenSSL at all.

@EmberCoin EmberCoin added the bug label Aug 3, 2017
@EmberCoin EmberCoin self-assigned this Aug 3, 2017
@aaashes
Copy link
Author

aaashes commented Aug 4, 2017

Originally avoided even mentioning other alternatives asides from our beloved trash fire.
Promising to hear you're in favor of replacing. Its one of the more cleaner and concise libs out there for secure sockets, with mbedTLS taking second place.

@EmberCoin
Copy link
Owner

Fixed by #10
Leaving open until GUI build fixes.

@EmberCoin
Copy link
Owner

I had to revert to OpenSSL 1.0.2 in switching off windows architecture. I will try libressl again once we get building with mingw64 works (mingw32 is gross but at the time what they used)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants