3

From: https://marc.info/?l=openbsd-announce&m=140752800525709

The announcement:

We have released LibreSSL 2.0.5, which should be arriving in the
LibreSSL directory of an OpenBSD mirror near you.

This version forward-ports security fixes from OpenSSL 1.0.1i,
including fixes for the following CVEs:

CVE-2014-3506
CVE-2014-3507
CVE-2014-3508 (partially vulnerable)
CVE-2014-3509
CVE-2014-3510
CVE-2014-3511

LibreSSL 2.0.4 was not found vulnerable to the following CVEs:

CVE-2014-5139
CVE-2014-3512
CVE-2014-3505

We welcome feedback and support from the community as we
continue to work on LibreSSL.

Thank you,
 Brent

Our question is: Why wasn't LibreSSL affected by the CVE-2014-5139, CVE-2014-3512, CVE-2014-3505 and only partially vulnerable for: CVE-2014-3508? Can someone please explain in short?

The OpenSSL Security Advisory Link: https://www.openssl.org/news/secadv_20140806.txt

4
  • CVE-2014-5139 - crash with SRP ciphersuite in Server Hello message - SRP had been removed from LibreSSL in May 2014 so no fix was necessary.

  • CVE-2014-3512 - SRP buffer overrun - again not vulnerable because SRP is no longer part of LibreSSL

  • CVE-2014-3505 - Double Free when processing DTLS packets - this had been fixed independently by LibreSSL back in May 2014.

  • CVE-2014-3508 - openssl: information leak in pretty printing functions - LibreSSL did indeed provide a fix for it. I have no information why the LibreSSL 2.0.5 release announcement marked it "partially vulnerable", someone with knowledge on that topic could compare the LibreSSL fix to the OpenSSL fix to find out about that. Update: While searching for a more detailled explanation on that, I came across this thread, where someone pretty much asked the same questions and one of the OpenBSD developers explained for CVE-2014-3508:

    For -3508, one of the involved paths had been converted to snprintf() and could no longer leave the buffer unterminated, but we hadn't changed the other. Darn.

Note: I linked the CVEs to Redhat's Bugzilla, because they always link to the actual commitdiff fixing the issue, which is nice.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.