Re: TLS renegociation bug: time for OpenSSL upgrade?

[Emmanuel Dreyfus <manu%netbsd.org@localhost>]

On Mon, Nov 23, 2009 at 11:30:21AM +0100, Martin Husemann wrote:
> On Mon, Nov 23, 2009 at 10:26:31AM +0000, Emmanuel Dreyfus wrote:
> > In 5.0.1: OpenSSL 0.9.9-dev 09 May 2008. -current has the same, right?
> No, current has: OpenSSL 1.1.0-dev 10 Jul 2009

Still too old to have the TLS renegociation bugfix, anyway. And a
quick look at CVS reveals no patch since that time:
http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/external/bsd/openssl/dist/ssl/

I am looking for fixes in ssl/s3_lib.c

-- 
Emmanuel Dreyfus
manu%netbsd.org@localhost