OpenSSL releases several patches but none for serious issues

The OpenSSL project has released several patches for moderate flaws, including an additional defense against the Logjam vulnerability revealed last month.

OpenSSL is widely used open-source software that encrypts communications using the SSL/TLS (Secure Sockets Layer/Transport Layer Security) protocol. SSL/TLS prevents clear-text data from being transmitted across the Web, avoiding high security risks.

The patches include three for moderate flaws. Two of these fix flaws that could be used for denial of service attacks, according to an advisory. The third patch fixes a moderate flaw that affects OpenSSL versions prior to a June 2014 release. A fourth patch is for a low severity race condition flaw.

The latest versions of OpenSSL are now 1.0.2b, 1.0.1n, 1.0.0s and 0.9.8zg.

Another change in OpenSSL is an additional defense against the so-called Logjam flaw, which can allow an attacker to significantly weaken the encrypted connection between a user and a Web or email server.

Logjam lies specifically within a set of Diffie-Hellman algorithms, which facilitate the exchange of encryption keys before a connection is secured.

Software products that still support weak 512-bit encryption keys could be tricked into using that weak key, which can be calculated and then used to decrypt traffic.

OpenSSL will now reject handshakes that use Diffie-Hellman parameters shorter than 768 bits, the advisory said. Eventually, the limit will be raised to 1,024 bits.

The discovery of an alarming flaw called Heartbleed in April 2014 prompted a wide examination of OpenSSL, which is used by millions of web sites and email severs. An audit is still ongoing in OpenSSL with the aim of eliminating years-old but unknown flaws.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk