Date: Thu, 10 Dec 2020 22:46:28 -0800 From: John-Mark Gurney <jmg@funkthat.com> To: freebsd-security@freebsd.org Subject: Re: FreeBSD Security Advisory FreeBSD-SA-20:33.openssl Message-ID: <20201211064628.GM31099@funkthat.com> In-Reply-To: <20201209230300.03251CA1@freefall.freebsd.org> References: <20201209230300.03251CA1@freefall.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
FreeBSD Security Advisories wrote this message on Wed, Dec 09, 2020 at 23:03 +0000:
> versions included in FreeBSD 12.x. This vulnerability is also known to
> affect OpenSSL versions included in FreeBSD 11.4. However, the OpenSSL
> project is only giving patches for that version to premium support contract
> holders. The FreeBSD project does not have access to these patches and
> recommends FreeBSD 11.4 users to either upgrade to FreeBSD 12.x or leverage
> up to date versions of OpenSSL in the ports/pkg system. The FreeBSD Project
> may update this advisory to include FreeBSD 11.4 should patches become
> publicly available.
FreeBSD needs to reevaluate the continued reliance on OpenSSL for our
crypto/TLS library. 1.0.2 which is in 11-stable has not had support
for almost a year, and 11 is going to have almost another year of
support during which time if there's another vuln, we'll again be
leaving the users in a bad place.
I have not heard if OpenSSL has bother to address the breakage of
/dev/crypto that also recently came up, but it does appear that they
are no longer a good fit for FreeBSD.
Even as it stands, FreeBSD has committed to supporting 12 for close
to a year longer than OpenSSL has for 1.1.1 meaning we will be in the
same situation we are w/ 11 in a few years.
Assuming 13 releases w/ OpenSSL, we'll be even in a worse situation
than we are now. OpenSSL 3.0.0 has no support commitment announced
yet, and sticking with 1.1.1 for 13 will put us even in a worse
situation than we are today.
What are peoples thoughts on how to address the support mismatch between
FreeBSD and OpenSSL? And how to address it?
IMO, FreeBSD does need to do something, and staying w/ OpenSSL does
not look like a viable option.
--
John-Mark Gurney Voice: +1 415 225 5579
"All that I will do, has been done, All that I have, has not."
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20201211064628.GM31099>