https://www.hardening-consulting.com/enTue, 18 Feb 2025 22:51:03 GMTNikola (getnikola.com)http://blogs.law.harvard.edu/tech/rsshttps://www.hardening-consulting.com/en/posts/20140512openssl-and-valgrind.htmlDavid FORT<div><p><img class="alignright" src="https://www.hardening-consulting.com/images/valgrind.png"></p> <h2>Problem</h2> <p>OpenSSL has the "good" idea to use the stack as a source of entropy. This is the cause of the 2008 <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0166">debian</a> bug: the debian maintainer for OpenSSL was annoyed by valgrind warnings. So he did a fix that removed the error but introduced a main security issue: after the fix, the number of possible keys was so weak that it was possible to list them. The consequence is that all the cryptographic materials generated by this version had to be regenerated, and it probably remains plenty of servers running with vulnerable keys.</p> <p>So ok, the maintainer has been blamed, he did his mea culpa. But what can you do when you're annoyed by all these warnings ?</p> <p><a href="https://www.hardening-consulting.com/en/posts/20140512openssl-and-valgrind.html">Read more…</a> (3 min remaining to read)</p></div>Copensslvalgrindhttps://www.hardening-consulting.com/en/posts/20140512openssl-and-valgrind.htmlMon, 12 May 2014 13:03:19 GMT