Re: openssl wheezy update
On Tue, Jan 31, 2017 at 11:13:55PM +0100, Emilio Pozuelo Monfort wrote:
> Hi Kurt,
>
> I have prepared an update of openssl for wheezy based on 1.0.1t-1+deb8u6. I have
> done some smoke testing on it and it seems fine, but I haven't been able to
> verify the three fixes as I can't find exploits for them (there is mention of
> one for CVE-2016-8610 in [1] but I can't find the actual file).
>
> Do you have any suggestion for how to verify / test the update?
>
> Do you want to upload this or should I take care of it?
Feel free to upload this.
The usptream version in jessie and wheezy, so the patches should
just apply.
I only have a test for the 32 bit crashes. It would require to get
the fuzzers working in the 1.0.1 version, which should be that
hard.
The other would be a cache timing attack, and I really have no
good way to test that.
I suggest you just upload it.
Kurt
Reply to: