mirror of
https://boringssl.googlesource.com/boringssl
synced 2026-07-21 14:43:51 +00:00
David Benjamin
185121b4a4
When OpenSSL publishes advisories, we've maintained counterparts to help BoringSSL consumers determine how it affects them. Starting with the most recent one, we're planning to publish them in the repository under docs/advisories. This CL only has the most recent advisory. https://crbug.com/479225940 tracks converting the historical ones. Bug: 479225940 Change-Id: I01825cca2fe6c968ffbb6287b3ae6f890149e0e8 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/88067 Auto-Submit: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
1.3 KiB
1.3 KiB
Template for OpenSSL Advisories:
Instructions:
- Copy this file to
YYYY-MM-DD.mdin directory. - Fill in the title and table.
- If BoringSSL is not affected by any issue in the advisory add "(BoringSSL Not Affected)" to the title.
- Add sections to the end for any issues that warrant extended discussion, e.g. if the severity differs from OpenSSL, or if we have anything to add to OpenSSL's advisory.
- Delete this header.
OpenSSL Advisory: ${Month} ${Day}, ${Year}
OpenSSL have published a security advisory. Here's how it affects BoringSSL:
| CVE | Summary | Severity in OpenSSL | Impact to BoringSSL |
|---|---|---|---|
| CVE-YYYY-NNNN | Buffer overflow printing favorite color | High | Not affected, impacted code was removed from BoringSSL in the initial fork |
| CVE-YYYY-NNNN | Library misreports favorite color | Moderate | Not affected, issue was introduced after fork |
| CVE-YYYY-NNNN | Timing side channel in favorite color calculation | Low | Affected. Fixed in ... |
| CVE-YYYY-NNNN | Null pointer dereference when enumerating colors | Low | See discussion below. Fixed in ... |
CVE-YYYY-NNNN
If we need to write a lot about an issue, put it in a section like this.