SeaCat Technology and the Latest OpenSSL Update (1.1.0e)
February 21, 2017
OpenSSL released a new version on February 16, 2017. The new version fixed one high-severity issue regarding renegotiation of the Encrypt-then-MAC (EtM) extension, an approach to authenticated encryption. The vulnerability is identified as CVE-2017-3733. Several, not yet known, cipher suites are affected; therefore disabling affected cipher suites can not be used as a workaround.
TeskaLabs’ SeaCat technology uses the 1.0.2 series for its cryptography library, so this update does not affect our technology in any way.
Recommendation:
Your systems and applications are affected if they use OpenSSL 1.1.0 series. EtM is the strongest approach to authenticated encryption. We strongly recommend you to update to the latest version.
Your application developers or operators should inform you about update requirements. If you have any concern about the security of your systems, we are ready to help you.
If you have any question, please contact support@teskalabs.com. Alternatively, look at our documentation to know more about SeaCat application security technology.
Most Recent Articles
- A beginner-friendly intro to the Correlator for effective cybersecurity detection
- Inotify in ASAB Library
- From State Machine to Stateless Microservice
- Entangled ways of product development in the area of cybersecurity #3 - LogMan.io
- Entangled ways of product development in the area of cybersecurity #2 - BitSwan
You Might Be Interested in Reading These Articles
SeaCat Application Security Technology Is Not Impacted by the Dirty Cow Issue (CVE-2016-5195)
The new vulnerability, DirtyCOW, (CVE-2016-5195) exploits a flaw in private read-only memory mappings. However, this critical impact vulnerability has existed in Linux for nine years and only got discovered recently.
Published on October 25, 2016
OpenSSL DROWN Vulnerability Affects Millions of HTTPS Websites and Software Supporting SSLv2 (CVE-2016-0800)
DROWN is caused by legacy OpenSSL SSLv2 protocol, known to have many deficiencies. Security experts have recommended to turn it off, but apparently many servers still support it because disabling SSLv2 requires non-default reconfiguration of the SSL cryptographic settings which is not easy for common IT people who have limited security knowledge and don’t know the location to disable this protocol and the way to disable it.
Published on April 12, 2016
OpenSSL emergency release impact analysis re TeskaLabs' SeaCat
We help you to operate your mobile app(s) securely. You might have noticed that OpenSSL has recently announced an emergency release because they identified a series of security defects, rated with maximum severity High. The version of fixed OpenSSL is 1.0.2h, released on 3rd May 2016.
Published on May 04, 2016