OpenSSL vulnerability 1.0.x

[robinsondan87]

Are there any plans to update OpenSSL to 1.1.x to block the below vulnerability?

https://www.openssl.org/blog/blog/2016/08/24/sweet32/

Thanks

[yosifkit]

This is a general issue with the DES/triple-DES protocols. libssl would be updated to 1.1.x series by #84. But really is just a configuration issue:

If you run a server, you should disable triple-DES. This is generally a configuration issue. If you run an old server that doesn’t support any better ciphers than DES or RC4, you should upgrade.

https://www.openssl.org/blog/blog/2016/08/24/sweet32/

See also: https://httpd.apache.org/docs/2.4/ssl/ssl_howto.html#ciphersuites