{"action":"created","issue":{"url":"https://api.github.com/repos/ostroproject/ostro-os-xt/issues/40","repository_url":"https://api.github.com/repos/ostroproject/ostro-os-xt","labels_url":"https://api.github.com/repos/ostroproject/ostro-os-xt/issues/40/labels{/name}","comments_url":"https://api.github.com/repos/ostroproject/ostro-os-xt/issues/40/comments","events_url":"https://api.github.com/repos/ostroproject/ostro-os-xt/issues/40/events","html_url":"https://github.com/ostroproject/ostro-os-xt/issues/40","id":179119687,"number":40,"title":"OpenSSL CVE-2016-6304","user":{"login":"testkit","id":1468984,"avatar_url":"https://avatars.githubusercontent.com/u/1468984?v=3","gravatar_id":"","url":"https://api.github.com/users/testkit","html_url":"https://github.com/testkit","followers_url":"https://api.github.com/users/testkit/followers","following_url":"https://api.github.com/users/testkit/following{/other_user}","gists_url":"https://api.github.com/users/testkit/gists{/gist_id}","starred_url":"https://api.github.com/users/testkit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/testkit/subscriptions","organizations_url":"https://api.github.com/users/testkit/orgs","repos_url":"https://api.github.com/users/testkit/repos","events_url":"https://api.github.com/users/testkit/events{/privacy}","received_events_url":"https://api.github.com/users/testkit/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ostroproject/ostro-os-xt/labels/bug","name":"bug","color":"ee0701"},{"url":"https://api.github.com/repos/ostroproject/ostro-os-xt/labels/security","name":"security","color":"b60205"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-09-26T00:48:29Z","updated_at":"2016-09-27T14:00:39Z","closed_at":null,"body":"OCSP Status Request extension unbounded memory growth (CVE-2016-6304)\r\n- A malicious client can send an excessively large OCSP Status Request extension. If that client continually requests renegotiation, sending a large OCSP Status Request extension each time, then there will be unbounded memory growth on the server. This will eventually lead to a Denial Of Service attack through memory exhaustion. Servers with a default configuration are vulnerable even if they do not support OCSP. Builds using the \"no-ocsp\" build time option are not affected.\r\n- Severity: HIGH\r\n- Update 1.1.0 to 1.1.0a; 1.0.2 to 1.0.2i; 1.0.1 to 1.0.1u.\r\n- OpenSSL blog: https://www.openssl.org/news/secadv/20160922.txt\r\n- Issue reported by: Shi Lei (Qihoo 360 Inc.)\r\n  · Multiple low severity OpenSSL vulnerabilities were reported along with above CVE and are listed in the OpenSSL blog below.\r\n- OpenSSL blog : https://www.openssl.org/news/secadv/20160922.txt\r\n\r\n(Report for Demeter, Michael)"},"comment":{"url":"https://api.github.com/repos/ostroproject/ostro-os-xt/issues/comments/249873446","html_url":"https://github.com/ostroproject/ostro-os-xt/issues/40#issuecomment-249873446","issue_url":"https://api.github.com/repos/ostroproject/ostro-os-xt/issues/40","id":249873446,"user":{"login":"pohly","id":22076,"avatar_url":"https://avatars.githubusercontent.com/u/22076?v=3","gravatar_id":"","url":"https://api.github.com/users/pohly","html_url":"https://github.com/pohly","followers_url":"https://api.github.com/users/pohly/followers","following_url":"https://api.github.com/users/pohly/following{/other_user}","gists_url":"https://api.github.com/users/pohly/gists{/gist_id}","starred_url":"https://api.github.com/users/pohly/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pohly/subscriptions","organizations_url":"https://api.github.com/users/pohly/orgs","repos_url":"https://api.github.com/users/pohly/repos","events_url":"https://api.github.com/users/pohly/events{/privacy}","received_events_url":"https://api.github.com/users/pohly/received_events","type":"User","site_admin":false},"created_at":"2016-09-27T14:00:39Z","updated_at":"2016-09-27T14:00:39Z","body":"None of these two new CVEs are applicable to Ostro OS XT + PR #39 (= openssl 1.0.2h + patch for CVE-2016-6304): CVE-2016-6309 only applies to 1.1.0a, and CVE-2016-7052 only to 1.0.2i. The code that CVE-2016-7052 fixes is not part of the backported patch either, so PR #39 should still address the current openssl problems.\r\n\r\n@terriko Do you agree? Please review PR #39 so that we can move forward with it."}}
{"actor":{"display_login":"pohly"}}