Millions of Devices Are Vulnerable to a Critical OpenSSL Bug

In this video I discuss the forthcoming OpenSSL 3.0.7 release which is supposed to include patches for a critical security vulnerability, the worst one in the OpenSSL library since Heartbleed. I also discuss some ways you could mitigate the vulnerability in the meantime.

₿💰💵💲Help Support the Channel by Donating Crypto💲💵💰₿

Monero
45F2bNHVcRzXVBsvZ5giyvKGAgm6LFhMsjUUVPTEtdgJJ5SNyxzSNUmFSBR5qCCWLpjiUjYMkmZoX9b3cChNjvxR7kvh436

Bitcoin
3MMKHXPQrGHEsmdHaAGD59FWhKFGeUsAxV

Ethereum
0xeA4DA3F9BAb091Eb86921CA6E41712438f4E5079

Litecoin
MBfrxLJMuw26hbVi2MjCVDFkkExz8rYvUF

Dash
Xh9PXPEy5RoLJgFDGYCDjrbXdjshMaYerz

Zcash
t1aWtU5SBpxuUWBSwDKy4gTkT2T1ZwtFvrr

Chainlink
0x0f7f21D267d2C9dbae17fd8c20012eFEA3678F14

Bitcoin Cash
qz2st00dtu9e79zrq5wshsgaxsjw299n7c69th8ryp

Etherum Classic
0xeA641e59913960f578ad39A6B4d02051A5556BfC

USD Coin
0x0B045f743A693b225630862a3464B52fefE79FdB

and be sure to click that notification bell so you know when new videos are released.

[midimusicforever]

And a year from now, there will still be critical infrastructure running old versions that has this bug.

[msddvisage]

This is the magic of open source:
something is bad, fix it yourself

[itsmeowdev]

Heartbleed was a buffer overread, not an overflow, overflows usually enable RCE/writing to memory.

[isaiahsmith]

Heart bleed explanation was well done. As a SWE with knowledge of most CVE, I still learned something from the video!

[HoshiFanatic]

I was working for a router company when Heartbleed came out. The amount of phone calls from customers were through the roof at that point. We had to get a new firmware version asap from the company, or they would've lost tons of business.

[Silentstrike_]

Thank you for raising awareness about this vulnerability! This is just another vulnerability that I would have completely missed if it wasn't for this channel.

[ricky]

You know it's a big deal when the Fedora team actually delayed the release of F37 just to wait for this patch.

[dreamhollow]

This reminds me of a warning that one of my programming instructors gave me about C++ arrays.
If you declare an array of a specific size, you must make sure there are no instructions in the program that allow you to override or request data beyond that size.
Should you do so, you create a huge vulnerability from the overflow. I'm guessing it's something like that? I'm not an expert on servers.

[fosres]

I would not agree with your recommendation to downgrade to OpenSSL 1.1.1q. Even if that fixes the high-class vulnerability--this should obviously make you vulnerable to an array of several more low and middle-class vulnerabilities. Switch to LibreSSL if possible or patch the vulnerability.

[disband_thebbc]

Is OpenSSL maintained by the NSA or the CIA? 🤔

[washinours]

I truly think we should start defining those people that "are so good at breaking down complex topics into a short and understandable concept to anyone" as "an xkcd"
Seriously Randall's so good at this

[pupfriend]

FIPS validation is for specific versions of the cryptographic module. For OpenSSL, that version is 3.0.0. The database of FIPS validated modules is publicly accessible if you want to check. The validation does not apply to all of 3.X or even 3.0.X. So, if a government organization or gov contractor were to patch for this vulnerability, they would be out of compliance with the stated regulations because the patched version is not FIPS validation. And, of course, there are only a few labs in the US that can perform the FIPS validation, and the waitlist is very long. So, as usual, the government shoots itself in the foot with stupid regulations.

[TheJjjet]

I'm starting to see why Rust is getting popular these days. So many vulnerabilities from memory safety.

[hsharma]

Security vul are actually really hard to pull off. Md5 took about 300 PlayStations to pull off with a very specific and coordinated attack, and it’s only ever been done in a lab situation. Sha1 was broken with a chosen prefix attack, which is EXTREMELY difficult to pull off.

[shapelessed]

Excuse me?
As a fullstack web developer hearing that OpenSSL doesn't peoperly verify the length of the message is just... How did that even get to production? That's one of the simplest things you need to check while doing any communication with untrusted computers. First thing you do in such cases is limit message length and limit acceptable characters/bytes - depending if you're working with raw data or just text.

[drrenard]

I have systems that are 140-2 (FIPS) and need 3.x. Thanks for heads up. I may give notice of system down and keep them offline tell update

[davidd]

I thought this new CVE is only effects x.509 certs (digital signatures) which should only be used for email? I have updated that certs on exchange implementations with no downtime (Newer exchange versions is all done in EAC with like 2 or 3 clicks. Now if its used for the DKIMit might be a little harder to fix.

[honkhonk]

I wish news companies put it out like that comic before.
Really explained it well.
I hate how obfuscated the documentation can be sometimes for software lol.

[aurele]

Look at you, big man! You got a shoutout from Fireship on YT on your Metaverse vid.

[localboxcrox]

Funny thing: I'm on MacOS Ventura and I have LibreSSL by default instead of OpenSSL. /usr/bin/openssl is LibreSSL 3.3.6.