topic Re: Field Test version of SSL T1.4 is now available in the web! in Operating System - OpenVMS

Field Test version of SSL T1.4 is now available in the web!

Srividhya Subramanian — Tue, 08 Sep 2009 03:27:39 GMT

http://h71000.www7.hp.com/openvms/products/ssl/ssl.html

This new release is based on OpenSSL 0.9.8h and it includes all latest security updates from openssl.org.

Since SSL is not backward compatible, I request all SSL consumers to rebuild your application (to make use of this latest SSL version for VMS).

Please let us know if you find any problems/issues while building/testing your application.

In another one month we will be releasing the V version.

Regards
Srividhya

Re: Field Test version of SSL T1.4 is now available in the web!

Jon Pinkley — Tue, 08 Sep 2009 05:04:47 GMT

Srividhya,

Thanks for the pointer.

From the

HP SSL Version T1.4 for OpenVMS
Installation Guide and Release Notes

September 2009
-------------------------------------------------------------------

http://h71000.www7.hp.com/openvms/products/ssl/ssl_iguide.txt

Software Prerequisites

HP SSL for OpenVMS requires the following software.

- Operating System

HP OpenVMS Alpha Version 8.2-1 or higher, or
HP OpenVMS Integrity server Version 8.2-1 or higher

- TCP/IP Transport

HP TCP/IP Services for OpenVMS Version 5.6 or higher (for HP SSL on
OpenVMS Integrity server and OpenVMS Alpha Version 8.2 or higher), or

HP TCP/IP Services for OpenVMS Version 5.4 or higher (for HP SSL on
OpenVMS Alpha Version 7.3-2)

-------------------------------------------------------------------

If OpenVMS Alpha Version 8.2-1 or higher is required, why does this show up?

HP TCP/IP Services for OpenVMS Version 5.4 or higher (for HP SSL on
OpenVMS Alpha Version 7.3-2)

Is the T1.4 field test compatible with 7.3-2 / TCPIP 5.4 or not?

Jon

Re: Field Test version of SSL T1.4 is now available in the web!

Volker Halle — Tue, 08 Sep 2009 08:49:45 GMT

Jon,

these probably are cut & paste errors and indicate, that noone is really cross-checking those documents for correctness - EXCEPT the OpenVMS customers ;-)

As we all know, there is no version of OpenVMS Alpha V8.2-1 nor will there ever be one.

Volker.

Re: Field Test version of SSL T1.4 is now available in the web!

Srividhya Subramanian — Tue, 08 Sep 2009 09:30:24 GMT

Jon,
->
Is the T1.4 field test compatible with 7.3-2 / TCPIP 5.4 or not?
->
No. We have not qualified with 7.3-2.

Re: Field Test version of SSL T1.4 is now available in the web!

Hoff — Tue, 08 Sep 2009 13:19:38 GMT

FWIW, here are the release announcements and the published CHANGES.TXT for OpenSSL directly from the OpenSSL folks:

http://www.openssl.org/news/announce.html

Re: Field Test version of SSL T1.4 is now available in the web!

Steven Schweda — Tue, 08 Sep 2009 14:06:22 GMT

> http://h71000.www7.hp.com/openvms/products/ssl/ssl.html

[...] based on OpenSSL 0.9.8h and
includes the following latest security
updates, known to date [...]

Known to _which_ date? The latest OpenSSL
kit (as of today) is version 0.9.8k, not
0.9.8h. How latest is your "latest"?

Unqualified, "latest" is seldom a useful
description.

Re: Field Test version of SSL T1.4 is now available in the web!

Ian Miller. — Tue, 08 Sep 2009 15:07:35 GMT

I note in http://h71000.www7.hp.com/openvms/products/ssl/ssl_iguide.txt

there are some updates backported from 0.9.9

Re: Field Test version of SSL T1.4 is now available in the web!

Srividhya Subramanian — Wed, 16 Sep 2009 11:00:35 GMT

After 0.9.8h release, OpenSSL has released till now the following two security advisories.

07-Jan-2009:
Security Advisory: incorrect checks for malformed signatures

25-Mar-2009:
Security Advisory: Three moderate severity security issues

We have ported these two advisories (thatâ s why we have put â it includes the following latest security updates, known to dateâ in the website)

Vulnerabilities CVE/CAN:

CVE-2008-5077
CVE-2009-0590
CVE-2009-0591
CVE-2009-0789