OpenSSL Blog

CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buffer Overflows

Posted by OpenSSL Security Team ,

Today we published an advisory about CVE-2022-3786 (“X.509 Email Address Variable Length Buffer Overflow”) and CVE-2022-3602 (“X.509 Email Address 4-byte Buffer Overflow”).

Please read the advisory for specific details about these CVEs and how they might impact you. This blog post will address some common questions that we expect to be asked about these CVEs.

Configuring Supported TLS Groups in OpenSSL

Posted by Tomáš Mráz ,

The configuration of supported groups in TLS servers is important to limit the resource consumption of the TLS handshakes performed by the server. This blog post should give system administrators a few useful hints on how to configure the OpenSSL library and two of the most used open source HTTP servers which use the OpenSSL library for supporting the HTTPS protocol.

OpenSSL Presentation at ICMC22 Conference

Posted by Martin Koci ,

After 2 years of forced covid break, OpenSSL once again presented at the ICMC22 conference. The conference was a very pleasant meet-up of the community around cryptography and cryptographic modules. There were a lot of insights, feedback, and discussions around IT security. OpenSSL gave a talk on the Current Status of OpenSSL.

OpenSSL 3.0 FIPS 140-2 Free Rebranding Offer

Posted by OpenSSL Management Committee ,

OpenSSL is celebrating our FIPS 140-2 certification with a special offer for our Premium Support Customers by providing access to a free rebranding of the OpenSSL 3.0 FIPS 140-2 certificate.

See FIPS 140-2 Certificate here

OpenSSL Is Looking to Hire Full-time Position Platform Engineer

Posted by Martin Koci ,

UPDATE: Please note this position has been filled.

The OpenSSL Management Committee are looking to hire a full time Platform Engineer. This is a sysadmin role. Details of the roles follow.

To apply please send your cover letter and resume to jobs@openssl.org by 17th June 2022.