OpenSSL has issued several patches for two vulnerabilities, including six flaws that have the potential to allow hackers to both execute malicious code on a web server and decrypt HTTPS traffic. A significant number of internet services used OpenSSL to cryptographically protect sensitive web and email traffic using the Secure Sockets Layer (SSL) or Transport Layer Security (TLS) protocols. The traffic decryption flaw allows for a man-in-the-middle attacker to initiate what is known as a ‘Padding Oracle Attack’ that decrypts HTTPS traffic in cases where the connection uses AES-CBC cipher and the server supports AES-NI.
OpenSSL has issued several patches for six vulnerabilities, including two flaws that have the potential to allow hackers to both execute malicious code on a web server and decrypt HTTPS traffic. A significant number of internet services used OpenSSL to cryptographically protect sensitive web and email traffic using the Secure Sockets Layer (SSL) or Transport Layer Security (TLS) protocols. The traffic decryption flaw allows for a man-in-the-middle attacker to initiate what is known as a ‘Padding Oracle Attack’ that decrypts HTTPS traffic in cases where the connection uses AES-CBC cipher and the server supports AES-NI.