I have a question: Why was this not found before they put that code into a release? #OpenSSL 
Explanation: The latest openssl vulns are in a parser function for punycode. this is a new function in openssl 3.x, so there's no "this is legacy baggage" excuse. They added this code fairly recently.
It is the most unsurprising thing that code to parse something like punycode can contain buffer overflows. This should be the default assumption for everyone writing code in C.
The easiest way to test this is to use a fuzzer. The most simple fuzzer with the standard state of the art tool (libfuzzer) finds this in less than a second.
In summary: OpenSSL added new C parser code - notoriously vulnerable to memory corruption - without doing any basic security testing.
Sidenote: The man page for this function is quite unhelpful. I had to read the source code in order to understand how the parameters work. github.com/openssl/openss…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
