HugeDomains.com
Captcha security check knlab.com is for sale Please prove you're not a robot View Price Processing
Forthcoming OpenSSL releases (OpenSSL, 2015.03.16) - 高田純次ã«ãªã‚ŠãŸã„エンジニア ã®hatena
OpenSSL versions 1.0.2a, 1.0.1m, 1.0.0r and 0.9.8zfãŒ2015.03.19ã«ãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã‚‹ãã†ã§ã™ã€‚ 複数ã®ã‚»ã‚ュリティ修æ£ãŒå«ã¾ã‚Œã¦ã„ã‚‹ãã†ã§ã€ã‚»ã‚ュリティ影響ã¯ã€Œé«˜ã€ 影響「高ã€ã¯OpenSSL 1.0.2ã ã‘ã‹ï¼Ÿ The OpenSSL Groupã®Mark J Coxæ°ã«ã‚ˆã‚‹ã¨ã€Highã®è„†å¼±æ€§ã¯OpenSSL 1.0.2ã¨ã®ã“ã¨ã€‚ @solardiz @joshbressers @hanno right, the new High is 1.0.2 only, other versions new issues just Moderate and Low — Mark J Cox (@iamamoose) 2015, 3月 16 3ã¤ã®è„†å¼±æ€§ã®ä¿®æ£ãŒãƒžãƒ¼ã‚¸(2015.3.19 追記) 3ã¤ã®è„†å¼±ãŒãƒžãƒ¼ã‚¸ã•ã‚Œã€ã„ãšã‚Œã‚‚lowレベルã¨
[openssl-announce] Forthcoming OpenSSL releases
Matt Caswell matt at openssl.org Mon Mar 16 19:05:31 UTC 2015 Next message: [openssl-announce] Forthcoming OpenSSL releases Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Forthcoming OpenSSL releases ============================ The OpenSSL project team would like to announce the forthcoming release of OpenSSL versions 1.0.2a, 1.0.1m, 1
OpenSSL Cookbook | Feisty Duck
Chapter 1: Getting Started Getting Started Key and Certificate Management Server Configuration Creating a Private Certification Authority from Scratch Chapter 2: Testing with OpenSSL Sixteen sections cover testing of various aspects of TLS server configuration For all its warts, OpenSSL is one of the most successful and most important open source projects. It’s successful because it’s so widely us
「Google Chromeã€ãŒã€ŒOpenSSLã€ã®ä½¿ç”¨ã‚’ä¸æ¢--「BoringSSLã€ã«åˆ‡ã‚Šæ›¿ãˆ
å°åˆ·ã™ã‚‹ メールã§é€ã‚‹ テã‚スト HTML é›»åæ›¸ç± PDF ダウンãƒãƒ¼ãƒ‰ テã‚スト é›»åæ›¸ç± PDF クリップã—ãŸè¨˜äº‹ã‚’Myページã‹ã‚‰èªã‚€ã“ã¨ãŒã§ãã¾ã™ 「Google Chromeã€ã®ï¼ˆé–‹ç™ºè€…å‘ã‘）最新ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§ã€ã‚»ã‚ュリティプãƒãƒˆã‚³ãƒ«ã‚’実装ã™ã‚‹ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã€ŒOpenSSLã€ã®ä½¿ç”¨ãŒä¸æ¢ã•ã‚Œã€OpenSSLã‹ã‚‰ãƒ•ã‚©ãƒ¼ã‚¯ã—ãŸç‹¬è‡ªã®ã€ŒBoringSSLã€ã¸ã¨åˆ‡ã‚Šæ›¿ãˆã‚‰ã‚ŒãŸã€‚切り替ãˆã«é–¢ã™ã‚‹è©³ç´°ãªæƒ…å ±ã¯ã€Chromium Code Reviewsã§ç¢ºèªã§ãる。 OpenSSLã«ã¤ã„ã¦ã¯ã€ã„ã‚ゆる「Heartbleedã€è„†å¼±æ€§ãŒ4月ã«ç™ºè¦šã—ã€å¤§ããªè©±é¡Œã‚’呼んã 。ã“ã®è„†å¼±æ€§ã‚’çªã‹ã‚Œã‚‹ã¨ã€HTTPSを介ã—ã¦è¡Œã‚ã‚ŒãŸã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æ±ºæ¸ˆã®æƒ…å ±ãªã©ã®ã‚»ã‚ュアãªãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã®ä¸èº«ã ã‘ã§ãªãã€ãƒ—ライマリãŠã‚ˆã³ã‚»ã‚«ãƒ³ãƒ€ãƒªSSLã‚ー自体も盗ã¿è¦‹ã•ã‚Œã¦ã—ã¾ã†å¯èƒ½æ€§ãŒã‚ã£ãŸã€‚ã¾ãŸãã®å¾Œã€ä¸é–“者（MitM）攻撃をå¯
Google Is Maintaining A "BoringSSL" Fork Of OpenSSL - Phoronix
Google Is Maintaining A "BoringSSL" Fork Of OpenSSL Written by Michael Larabel in Google on 21 June 2014 at 05:00 AM EDT. 11 Comments A Google engineer has went public on Google's fork of OpenSSL that is tentatively dubbed BoringSSL. For years Google has maintained their own set of dozens of patches atop OpenSSL that haven't been upstreamed over breaking API/ABI compatibility, being too experiment
OpenSSLã®è„†å¼±æ€§CCS Injection(CVE-2014-0224)ã®æ”»æ’ƒãŒè¡Œã‚れるæã‚ŒãŒã‚るパターンをマトリックス化ã—ã¦ã¿ãŸã€‚ - piyolog
lepidum社ã®èŠæ± æ°ãŒOpenSSLã®å®Ÿè£…ã«è„†å¼±æ€§ãŒã‚ã‚‹ã“ã¨ã‚’発見ã—ã¾ã—ãŸã€‚ã“ã®è„†å¼±æ€§ã¯ChangeCipherSpecメッセージã®å‡¦ç†ã«æ¬ 陥ãŒã‚ã‚‹ã‚‚ã®ã§ã€æ‚ªç”¨ã•ã‚ŒãŸå ´åˆã«æš—å·é€šä¿¡ã®æƒ…å ±ãŒæ¼ãˆã„ã™ã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã¨åŒç¤¾å…¬é–‹æƒ…å ±ã§ã¯èª¬æ˜Žã•ã‚Œã¦ã„ã¾ã™ã€‚ å°šã€6月6æ—¥ã«ãƒ¬ãƒ”ダム社ãŒã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã®å½è£…ã‚’è¡Œã†æ”»æ’ƒãŒè¡Œã‚れるæã‚Œã«ã¤ã„ã¦å±é™ºãŒãªã„ã“ã¨ãŒç¢ºèªã•ã‚ŒãŸã¨ã—ã¦è¨‚æ£ã‚’è¡Œã„ã¾ã—ãŸã€‚ãã‚Œã«ä¼´ã„以下ã®å†…容も修æ£ã‚’åŠ ãˆã¦ã„ã¾ã™ã€‚(ä¿®æ£å‰ã®è¨˜äº‹ã¯éšæ‹“ã‚’å‚ç…§ã—ã¦ãã ã•ã„。) lepidum社 å…¬é–‹æƒ…å ± 当社ã§ç™ºè¦‹ã—å ±å‘Šã‚’ã—ãŸOpenSSLã®è„†å¼±æ€§ï¼ˆCVE-2014-0224 ）ãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚早急ãªæ›´æ–°ãŒæœ›ã¾ã‚Œã‚‹å†…容ã ã¨è€ƒãˆã¦ã„ã¾ã™ã€‚ #ccsinjection #OpenSSL 概è¦ã¯ã“ã¡ã‚‰ã®ãƒšãƒ¼ã‚¸ã‚’ã”å‚照下ã•ã„。http://t.co/bhY7GpLZ2j— lepidum (@lepidum) 2
ã‚»ã‚ュリティ診æ–・検査ã®GMOサイãƒãƒ¼ã‚»ã‚ュリティ byイエラエ
GMOサイãƒãƒ¼ã‚»ã‚ュリティ byã‚¤ã‚¨ãƒ©ã‚¨æ ªå¼ä¼šç¤¾ã¯å›½å†…トップクラスã®ãƒ›ãƒ¯ã‚¤ãƒˆãƒãƒƒã‚«ãƒ¼ãŒå¤šæ•°åœ¨ç±ã™ã‚‹ã‚µã‚¤ãƒãƒ¼ã‚»ã‚ュリティã®ä¼šç¤¾ã§ã™ã€‚攻撃手法ã«é–¢ã™ã‚‹è±Šå¯ŒãªçŸ¥è˜ã¨æœ€å…ˆç«¯ã®æŠ€è¡“ã‚’æŒã¤ãƒ›ãƒ¯ã‚¤ãƒˆãƒãƒƒã‚«ãƒ¼ãŒä»®æƒ³æ•µã¨ãªã‚Šã€ãŠå®¢æ§˜ã®æŠ±ãˆã‚‹ã‚»ã‚ュリティ上ã®å•é¡Œã®å¯è¦–化ã¨èª²é¡Œè§£æ±ºã‚’サãƒãƒ¼ãƒˆã—ã¾ã™ã€‚ 「誰もãŒçŠ 牲ã«ãªã‚‰ãªã„社会を創るã€ã‚’ミッションã¨ã—ã¦æŽ²ã’ã€ãƒ‡ã‚¸ã‚¿ãƒ«ãƒã‚¤ãƒ†ã‚£ãƒ–ã®æ™‚代を生ãã‚‹ã™ã¹ã¦ã®äººãŒå®‰å…¨ã«æš®ã‚‰ã›ã‚‹ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆç¤¾ä¼šå‰µã‚Šã«è²¢çŒ®ã—ã¾ã™ã€‚
Heartbleedç¦ã®OpenSSLã¯ï½¢ã‚‚ã¯ã‚„修復ä¸èƒ½ï½£ã€‚OpenBSDãŒãƒ•ã‚©ãƒ¼ã‚¯ç‰ˆé–‹ç™ºã¸
Heartbleedç¦ã®OpenSSLã¯ï½¢ã‚‚ã¯ã‚„修復ä¸èƒ½ï½£ã€‚OpenBSDãŒãƒ•ã‚©ãƒ¼ã‚¯ç‰ˆé–‹ç™ºã¸2014.04.24 18:005,194 satomi サイトãŒã˜ã‚ã˜ã‚æ¥ã¾ã™ã…。 OpenSSLã®ãƒ˜ãƒžã§Heartbleedãªã‚“ã¦ãƒã‚°ãŒã§ãã¦ã—ã¾ã„ã€ã‚³ãƒ¼ãƒ‰ã‚’虱潰ã—ã«å½“ãŸã£ã¦ã„ãŸãƒ†ã‚ªãƒ»ãƒ‡ãƒ»ãƒ©ãƒ¼ãƒˆæ°çŽ‡ã„ã‚‹OpenBSDプãƒã‚¸ã‚§ã‚¯ãƒˆãŒï½¢ã“りゃ修復ä¸èƒ½ã ï½£ã¨åˆ¤æ–ã€ãƒ•ã‚©ãƒ¼ã‚¯ç‰ˆï½¢LibreSSLï½£ã®é–‹ç™ºã«ä¹—り出ã—ã¾ã—ãŸã€‚ Ars Technicaã‹ã‚‰ã®ãƒ¡ãƒ¼ãƒ«å–æã«å¯¾ã—ã€ãƒ©ãƒ¼ãƒˆæ°ã¯OpenSSLã®ãƒ€ãƒ¡ã£ã·ã‚Šã‚’ã“ã®ã‚ˆã†ã«æ›¸ã„ã¦ã„ã¾ã™ã€‚ ã†ã¡ã®ã‚°ãƒ«ãƒ¼ãƒ—ã§ã¯1週間ã‹ã‘ã¦OpenSSLã®ã‚½ãƒ¼ã‚¹ãƒ„リーã®ã†ã¡åŠåˆ†ã‚’削除ã—ãŸã€‚ã©ã‚Œã‚‚食ã„残ã—ã‚’ãã®ã¾ã¾æ•£ã‚‰ã‹ã—ã¦ã‚‹ã¿ãŸã„ãªä¸è¦ãªã¨ã“ã‚ã•ã€‚ オープンソースã®ãƒ¢ãƒ‡ãƒ«ã§ã¯ã€ã‚³ãƒ¼ãƒ‰ãŒã‚ã‹ã‚‹äººé–“ãŒé ¼ã¿ã 。é€æ˜Žæ€§ãŒé ¼ã¿ã€‚ã¨ã“ã‚ãŒã“ã‚ŒãŒã¾ã£ãŸãクリアãªã‚³ãƒ¼ãƒ‰ãƒ™ãƒ¼ã‚¹ã˜ã‚ƒãªã„ã‚ã‘よã。ãªãœ
OpenSSLã®è„†å¼±æ€§ã§æƒ³å®šã•ã‚Œã‚‹ãƒªã‚¹ã‚¯ - ã‚ã‚‚ãŠãã°
JVNã‚„JPCERT/CCã®è¨˜äº‹ãŒã‚ã¾ã‚Šã«ã‚‚ã•ã‚‰ã£ã¨æ›¸ã‹ã‚Œã¦ã„ã¦ã€å…·ä½“çš„ãªãƒªã‚¹ã‚¯ãŒæƒ³åƒã—ã¥ã‚‰ã„ã¨æ€ã†ã®ã§èª¬æ˜Žã—ã¾ã™ã€‚ ä»ŠåŒ—ç”£æ¥ (今ニュース見ã¦æ¥ãŸã‹ã‚‰ä¸‰è¡Œã§æ•™ãˆã¦æ¬²ã—ã„ã¨ã„ã†äººå‘ã‘ã®ã¾ã¨ã‚) インターãƒãƒƒãƒˆä¸Šã®ã€Œæš—å·åŒ–ã€ã«ä½¿ã‚ã‚Œã¦ã„ã‚‹OpenSSLã¨ã„ã†ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ãŒ2年間壊れã¦ã„ã¾ã—ãŸã€‚ ã“ã®ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã¯ä¾¿åˆ©ãªã®ã§ã€Facebookã ã¨ã‹YouTubeã ã¨ã‹ã€ã‚ã¡ã“ã¡ã®ã‚¦ã‚§ãƒ–サイトã§ä½¿ã£ã¦ã„ã¾ã—ãŸã€‚ ä»–ã®äººã®å…¥åŠ›ã—ãŸIDã¨ã‹ãƒ‘スワードã¨ã‹ã‚¯ãƒ¬ã‚«ç•ªå·ã¨ã‹ã‚’ã€æ‚ªã„人ãŒè¦‹ã‚‹ã“ã¨ãŒã§ãã¦ã—ã¾ã„ã¾ã™ã€‚(実際ã«æ¼ã‚Œã¦ã‚‹ä¾‹) ä»–ã«ã‚‚色々æ¼ã‚Œã¦ã¾ã™ãŒã€ã¨ã‚Šã‚ãˆãšã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ä»¥å¤–ã®äººãŒè¦šãˆã¦ãŠãã¹ãã¯ã“ã“ã¾ã§ã§OKã§ã™ã€‚ã‚‚ã†å°‘ã—分ã‹ã‚Šã‚„ã™ã„æƒ…å ±ãŒä»¥ä¸‹ã«ã‚ã‚Šã¾ã™ã€‚ OpenSSL ã®è„†å¼±æ€§ã«å¯¾ã™ã‚‹ã€ã‚¦ã‚§ãƒ–サイト利用者（一般ユーザ）ã®å¯¾å¿œã«ã¤ã„㦠ã¾ã ç›´ã£ã¦ã„ãªã„ウェブサイトもã‚ã‚Œã°ã€å…ƒã€…壊れã¦ã„ãªã„ウェブ
Test your server for Heartbleed (CVE-2014-0160)
If there are problems, head to the FAQ Results are now cached globally for up to 6 hours. Enter a URL or a hostname to test the server for CVE-2014-0160. This test has been discontinued in March 2019. You can use the open-source command line tool or the SSL Labs online test. All good, seems fixed or unaffected! Uh-oh, something went wrong: Check what it means at the FAQ. It might mean that the ser
CVE-2014-0160 OpenSSL Heartbleed 脆弱性ã¾ã¨ã‚ - ã‚ã‚‚ãŠãã°
å¿…è¦ãªæƒ…å ±ã¯ http://heartbleed.com/ ã«ã¾ã¨ã¾ã£ã¦ã„ã‚‹ã®ã§ã™ãŒã€è‹±èªžã ã—é•·ã„ã—ã£ã¦äººã®ãŸã‚ã«æ‰‹çŸã«ã¾ã¨ã‚ã¦ãŠãã¾ã™ã€‚ ã©ã†ã™ã‚Œã°ã„ã„ã®ã‹ OpenSSL 1.0.1〜1.0.1fを使ã£ã¦ã„ãªã‘ã‚Œã°ã‚»ãƒ¼ãƒ• ã‚ã¦ã¯ã¾ã‚‹å ´åˆã«ã¯ã€ä¸€åˆ»ã‚‚æ—©ããƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚¢ãƒƒãƒ—ã—ã¦ã€ã‚µãƒ¼ãƒã”ã¨å†èµ·å‹•(ã‚ã‹ã‚‹ã²ã¨ã¯ã‚µãƒ¼ãƒ“スå˜ä½ã§ã‚‚OKã€ãŸã ã—reloadã§ã¯ã ã‚ãªã“ã¨ã‚‚) SSL証明書ã§ã‚µãƒ¼ãƒã‚’公開ã—ã¦ã„ã‚‹ãªã‚‰ã€ç§˜å¯†éµã‹ã‚‰ä½œã‚Šç›´ã—ã¦è¨¼æ˜Žæ›¸ã‚’å†ç™ºè¡Œã—ã€éŽåŽ»ã®è¨¼æ˜Žæ›¸ã‚’失効ã•ã›ã‚‹(末尾ã«é–¢é€£ãƒªãƒ³ã‚¯ã‚ã‚Š)。 サーãƒã‚’公開ã—ã¦ã„ãªã„å ´åˆã‚‚ã€å¤–部ã¸ã®SSL通信ãŒã‚ã‚Œã°å½±éŸ¿ã‚’å—ã‘ã‚‹ã®ã§ã€è©³ã—ã精査ã™ã‚‹ã€‚ PFS(perfect forward secrecy)を利用ã—ã¦ã„ãªã„å ´åˆã€éŽåŽ»ã®é€šä¿¡å†…容も復å·ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ãŸã‚ã€è©³ã—ã精査ã™ã‚‹ã€‚ æ¼æ´©ã™ã‚‹æƒ…å ±ã®å…·ä½“例ã¯ã€OpenSSLã®è„†å¼±æ€§ã§æƒ³å®šã•ã‚Œã‚‹ãƒªã‚¹ã‚¯ã¨ã—ã¦
1
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
OpenSSL Security Advisory [11 Jun 2015]
OpenSSLã€4å¹´å‰ã‹ã‚‰å˜åœ¨ã™ã‚‹è„†å¼±æ€§ã«ãƒ‘ッム[インターãƒãƒƒãƒˆã‚³ãƒ ]
Heartbleedãƒã‚°ã®ã‚³ãƒ¼ãƒ‰ã‚’解説 - Qiita
{{#tags}}- {{label}}
{{/tags}}