New OpenSSL vulnerability, directly impacting Nginx

[Floren]

https://www.axivo.com/articles/new-openssl-vulnerability-discovered.15/
Please share the info with people who use RHEL/CentOS and Nginx, really important as many people running CentOS totally ignore this issue.

 

[Brent W]

OpenSSL has really taken a beating recently.

 

[Null]

https://www.axivo.com/articles/new-openssl-vulnerability-discovered.15/

Thank you for letting us know, @Floren.

I honestly believe more people should contribute to the OpenSSL project so they've got more resources – I've just sent them $250.00 (via PayPal).

 

[Floren]

The big guns already formed a fund coalition for OpenSSL: Amazon, Cisco, Dell, Facebook, Fujitsu, Google, IBM, Intel, Microsoft, NetApp, Rackspace, Qualcomm and VMWare. Each company will donate $100,000/year for 3 years. Apple decided is not important to participate... I can't stand this company.

 

[Brent W]

The big guns already formed a fund coalition for OpenSSL: Amazon, Cisco, Dell, Facebook, Fujitsu, Google, IBM, Intel, Microsoft, NetApp, Rackspace, Qualcomm and VMWare. Each company will donate $100,000/year for 3 years. Apple decided is not important to participate... I can't stand this company.

Maybe they figured 1.3 million a year is enough?

 

[Brent W]

For CentminMod users:

step 1. run command to patch OpenSSL 1.0.1g source for Nginx usage

curl -sL https://gist.github.com/centminmod/7e0a38b394d5d2f8fc7a/raw/releasebuffer.sh | bash

step 2. Set OPENSSL_VERSION='1.0.1g' version set in centmin.sh

step 3. Run centmin.sh menu option #4 recompile Nginx. When prompted if you want to recompile OpenSSL - select YES

 

[Null]

The big guns already formed a fund coalition for OpenSSL: Amazon, Cisco, Dell, Facebook, Fujitsu, Google, IBM, Intel, Microsoft, NetApp, Rackspace, Qualcomm and VMWare. Each company will donate $100,000/year for 3 years. Apple decided is not important to participate... I can't stand this company.

I think Apple deprecated the use of OpenSSL a few years back (at least, that's the impression I got from WWDC).

 

[MattW]

For CentminMod users:

step 1. run command to patch OpenSSL 1.0.1g source for Nginx usage

curl -sL https://gist.github.com/centminmod/7e0a38b394d5d2f8fc7a/raw/releasebuffer.sh | bash

step 2. Set OPENSSL_VERSION='1.0.1g' version set in centmin.sh

step 3. Run centmin.sh menu option #4 recompile Nginx. When prompted if you want to recompile OpenSSL - select YES

Just patched 4 servers

 

[rdn]

And also mine, Thanks @Floren @MattW

 

[Floren]

I think Apple deprecated the use of OpenSSL a few years back (at least, that's the impression I got from WWDC).

With the revenue they have, I think they can afford a donation of $300,000 which is BTW tax deductible.
After they ripped entirely FreeBSD to make their MacOS and bribed the developers with few pennies to have their mouths shut, they could at least support Open Source...

 

[euantor]

The big guns already formed a fund coalition for OpenSSL: Amazon, Cisco, Dell, Facebook, Fujitsu, Google, IBM, Intel, Microsoft, NetApp, Rackspace, Qualcomm and VMWare. Each company will donate $100,000/year for 3 years. Apple decided is not important to participate... I can't stand this company.

Not all of that is going to OpenSSL though. It's a collective fund to help struggling Open Source projects IIRC.

 

[Moshe1010]

With the revenue they have, I think they can afford a donation of $300,000 which is BTW tax deductible.
After they ripped entirely FreeBSD to make their MacOS and bribed the developers with few pennies to have their mouths shut, they could at least support Open Source...

There are better causes to support than crappy OpenSSL. Why would they support something they don't use? Because they have money? So? The above companies are using it, so they have an interest to support it.

 

[Amaury]

@Nights: Check and see if our server's affected by this.

 

[Dinosaur]

Thanks for the news, @Floren.