The OpenSSL has a critical flaw again:
This issue only affects OpenSSL 1.0.2i, released on 22nd September 2016.
A bug fix which included a CRL sanity check was added to OpenSSL 1.1.0
but was omitted from OpenSSL 1.0.2i. As a result any attempt to use
CRLs in OpenSSL 1.0.2i will crash with a null pointer exception.
OpenSSL 1.0.2i users should upgrade to 1.0.2j
https://www.openssl.org/news/secadv/20160926.txt
That's comforting to know, thanks.At a first glance, I wouldn't worry too much about this. To be exploited, it would require that a) you use a publicly emitted certificate, b) that certificate would use a CRL to check for revokation (AFAIK, most providers have switched to OCSP), c) someone would have to compromise the server providing the CRL
That's based on my understanding as to how CRL works.
Hi, Thanks for your Firm @RMerlin Currently i had installed last stock firm Asus on rt ac68u. how should i install it Version firmware ? any howto ?
thanks a lot.
I detect a little bug : when you try to edit a VPN PPTP acount , the field's names are not according to what they are supposed to design : asking for network/hostIP and netmask instead of name/password .
I detect a little bug : when you try to edit a VPN PPTP acount , the field's names are not according to what they are supposed to design : asking for network/hostIP and netmask instead of name/password .
We use essential cookies to make this site work, and optional cookies to enhance your experience.