openSSL 3.0.7 - any timelines yet?

[chemlud]

https://www.computerweekly.com/news/252526709/Prepare-today-for-potentially-high-impact-OpenSSL-bug

...?

[ProximusAl]

It's my understanding that OPNSense uses OPENSSL 1.1.1 so it's not affected.

[seed]

root@OPNsense:~ # openssl version
OpenSSL 1.1.1o-freebsd  3 May 2022

Edit:

Versions       OPNsense 22.7.6-amd64
                   FreeBSD 13.1-RELEASE-p2
                   OpenSSL 1.1.1q 5 Jul 2022

[almodovaris]

root@OPNsense:~ # /usr/local/bin/openssl version
OpenSSL 1.1.1q  5 Jul 2022

[chemlud]

So it's consensus that only 3.x is vulnerable? Any source for that conclusion yet?

[ProximusAl]

Erm...yes....the very hyperlink you posted above?

[Patrick M. Hausen]

@chemlud - the article you linked in your initial post?

What is known is that the incoming vulnerability only affects 3.0.x versions of OpenSSL

What's all the fuss about? OPNsense does not use this particular product, why should Deciso or the OPNsense team publish anything at all?

[chemlud]

I asked two questions, I don't see any "fuss". Nice to know that sense is not affected...

[RamSense]

jup indeed.
The only strange thing I found was that opnsense gui states:
OPNsense 22.7.6-amd64
FreeBSD 13.1-RELEASE-p2
OpenSSL 1.1.1q 5 Jul 2022

and the terminal window:
openssl version
OpenSSL 1.1.1o-freebsd

so why is the gui claiming version 1q and terminal gives back 1o?

[Deku]

What about LibreSSL?  My OpnSense is currently on LibreSSL 3.3.6.  I see version 3.6.1 was just released but not sure if this vuln applies.

[Fright]

@RamSense

so why is the gui claiming version 1q and terminal gives back 1o?

widget shows ports version (/usr/local/bin/openssl version)
shell shows base (OS) version (/usr/bin/openssl version)

@Deku
no
https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/
openssl only.
3.0 branch only

[RamSense]

@Fright, ah, thanks for explaining!

[almodovaris]

openssl 1.1.1s has been published.

[ibb27]

What about LibreSSL?  My OpnSense is currently on LibreSSL 3.3.6.  I see version 3.6.1 was just released but not sure if this vuln applies.

https://marc.info/?t=166716388700001&r=1&w=2

[chemlud]

Is LibreSSL still functional with 22.7.x? It was my understanding that support of LibreSSL would be deleted with 22.7 (but for the last months I didn't have the ttime to follow up) so I switched to openSSL before updating to 22.7...