¶ºÒõ¹Ý

Early this morning, the OpenSSL project team released the to fix a security vulnerability found in OpenSSL 1.1.0. Version 1.0.2 is not affected. However, system admins should patch their 1.1.0 OpenSSL framework immediately.

Encrypt-Then-Mac renegotiation crash (CVE-2017-3733)

Basically, when a client and a server renegotiate a handshake, if the Encrypt-Then-Mac extension is used and it was not part of the original negotiation, or if the Encrypt-Then-Mac extension was part of the original handshake but left out of the renegotiation, this can cause your instance of OpenSSL 1.1.0 to crash (depending on the ciphersuite being used), affecting both the server and the client. See more here:Ìý.

What’s the impact?

This vulnerability appears to only exist in OpenSSL version 1.1.0. If you are running an instance of OpenSSL version 1.0.2, you are not affected.

What should I do?

Administrators should update their instances of OpenSSL 1.1.0 to 1.1.0e. Source code for all the OpenSSL patches is available atÌý.

Keeping Your OpenSSL Instance Secure

OpenSSL continues to make sure that the OpenSSL framework remains strong and secure. This requires the OpenSSL team to remain vigilant at finding and patching vulnerabilities before attackers can find and exploit them. However, your OpenSSL instance and the broader community in general can only remain strong if you take the time to patch your systems.