Forum Discussion

Simon_Waters_13's avatar
Simon_Waters_13
Icon for Cirrostratus rankCirrostratus
Mar 19, 2015

Today's OpenSSL vulnerabilities - what are best channels for updates?

OpenSSL have given heads-up on release of high severity issue between 11am and 3pm today.   Have F5 been given advanced notice on these issues? e.g. Do they expect to issue a fix immediately the ...
management
security
amolari's avatar
amolari
Icon for Cirrus rankCirrus
Mar 19, 2015

Devcentral is the faster channel so far (past experience showed). Then, F5 publishes a SOL (sec advisory). Many times, a workaround is proposed (configuration of SSL profiles usually).

 

F5 might change the way one can update its product in the future: allowing some base (OS) components to be individually updated, without the need of a SW hotfix.

 

Updating OpenSSL might have some bad side-effects: I have seen that CRL imports (performed by OpenSSL on the BIGIP) is more resources intensive with the newer OpenSSL versions (such as in v11.6) than in previous ones.