OpenSSL would like to thank everyone who has provided feedback on our draft
mission & values statement.
The response has been great, and the feedback is really important to us. We are
working through those responses.
We’d like to get even more feedback so we are extending the response
period until 19th May 2023.
If you haven’t already provided feedback to us, please do so by:
As a small incentive we will be randomly selecting 10 responders out of
everyone who has provided feedback and the lucky ones will receive an OpenSSL
T-shirt. (Yes this includes those who have already responded to us).
Following the successful OpenSSL 2023 face-to-face conference, OpenSSL has produced a draft mission &
values statement. Once finalised, we intend to realign all activities of the
project to ensure they reflect our agreed mission and values. Before doing so
however, we would like to obtain feedback on this statement from the public, to
ensure it represents all of our communities. By offering us your feedback, you
will help us to ensure the OpenSSL project is run in a way that reflects the
values of all of our users.
We are now less than 6 months away from the End Of Life (EOL) date for the
OpenSSL 1.1.1 series. Users of OpenSSL 1.1.1 should consider their options and
plan any actions they might need to take.
We are thrilled to inform you that the complimentary FIPS rebranding
service for our premium support customers has been extended. As part
of this non-contractual benefit, premium support customers are entitled
to one rebranding of any of our FIPS provider certificates per year,
completely free of charge.
The OpenSSL Management Committee (OMC) and the OpenSSL Technical Committee
(OTC) are glad to announce our first beta release of OpenSSL 3.1. We consider
this to be a release candidate and as such encourage all OpenSSL users to build
and test against this beta release and provide feedback.
Today we published an
advisory about CVE-2022-3786
(“X.509 Email Address Variable Length Buffer Overflow”) and
CVE-2022-3602 (“X.509 Email Address 4-byte Buffer Overflow”).
Please read the advisory for specific details about these CVEs and how they
might impact you. This blog post will address some common questions that we
expect to be asked about these CVEs.
The configuration of supported groups in TLS servers is important to limit
the resource consumption of the TLS handshakes performed by the server.
This blog post should give system administrators a few useful hints
on how to configure the OpenSSL library and two of the most used
open source HTTP servers which use the OpenSSL library for supporting
the HTTPS protocol.
UPDATE: The post was updated to mention the new CVE-2022-40735 vulnerability.
With the release of OpenSSL 3.0 and the new provider architecture,
some algorithms that were considered legacy by the OpenSSL team at the
time were moved to the legacy provider, to be loaded optionally by
those wishing to still use any of said algorithms.