<story><title>OpenSSL bug exposed up to 255 bytes of client heap and existed since 2011</title><url>https://jbp.io/2024/06/27/cve-2024-5535-openssl-memory-safety.html</url></story><parent_chain><item><author>hannob</author><text>An interesting aspect of this is that it&amp;#x27;s a bug in NPN, which is more or less a historic artifact.&lt;p&gt;When SPDY, the precursor of HTTP&amp;#x2F;2, got introduced, it needed a mechanism to signal that within TLS, a different protocol (SPDY instead of HTTP&amp;#x2F;1.1) was spoken. That mechanism was originally NPN. I don&amp;#x27;t know the exact details and motivation, but eventually people seem to have decided that NPN wasn&amp;#x27;t exactly what they wanted, and they invented a new mechanism called ALPN.&lt;p&gt;Now, that was a decade ago (the ALPN RFC is from 2014), so the question is: why do we still have NPN code in OpenSSL? I don&amp;#x27;t think anyone uses it any more. Shouldn&amp;#x27;t it have been removed long ago?&lt;p&gt;To put this in a larger context: it appears to me that OpenSSL &lt;i&gt;still&lt;/i&gt; has a strong tendency to bloat. Heartbleed was essentially a &amp;quot;we added this feature, although noone knows why we need it&amp;quot; kind of bug, but it doesn&amp;#x27;t look to me they&amp;#x27;ve changed. I still get the feeling that OpenSSL adds many features that they probably just should ignore (e.g. obscure &amp;quot;not invented here&amp;quot;-type algorithms), and they don&amp;#x27;t remove features that are obsolete.</text></item></parent_chain><comment><author>fullspectrumdev</author><text>Why it’s not removed: backward compatibility I bet.&lt;p&gt;I have to maintain a few VM’s and statically linked tools specifically for interacting with old network appliances that modern Linux hosts won’t “talk to” without crippling their SSL&amp;#x2F;TLS configuration or doing other horrendous workarounds like specific OpenSSL&amp;#x2F;OpenSSH config files for those things.&lt;p&gt;It’s actually an interesting problem when performing security assessments - some tools for scanning will have false negatives because they can’t “talk to” old shit.</text></comment>
<story><title>OpenSSL bug exposed up to 255 bytes of client heap and existed since 2011</title><url>https://jbp.io/2024/06/27/cve-2024-5535-openssl-memory-safety.html</url></story><parent_chain><item><author>hannob</author><text>An interesting aspect of this is that it&amp;#x27;s a bug in NPN, which is more or less a historic artifact.&lt;p&gt;When SPDY, the precursor of HTTP&amp;#x2F;2, got introduced, it needed a mechanism to signal that within TLS, a different protocol (SPDY instead of HTTP&amp;#x2F;1.1) was spoken. That mechanism was originally NPN. I don&amp;#x27;t know the exact details and motivation, but eventually people seem to have decided that NPN wasn&amp;#x27;t exactly what they wanted, and they invented a new mechanism called ALPN.&lt;p&gt;Now, that was a decade ago (the ALPN RFC is from 2014), so the question is: why do we still have NPN code in OpenSSL? I don&amp;#x27;t think anyone uses it any more. Shouldn&amp;#x27;t it have been removed long ago?&lt;p&gt;To put this in a larger context: it appears to me that OpenSSL &lt;i&gt;still&lt;/i&gt; has a strong tendency to bloat. Heartbleed was essentially a &amp;quot;we added this feature, although noone knows why we need it&amp;quot; kind of bug, but it doesn&amp;#x27;t look to me they&amp;#x27;ve changed. I still get the feeling that OpenSSL adds many features that they probably just should ignore (e.g. obscure &amp;quot;not invented here&amp;quot;-type algorithms), and they don&amp;#x27;t remove features that are obsolete.</text></item></parent_chain><comment><author>toast0</author><text>&amp;gt; I don&amp;#x27;t know the exact details and motivation, but eventually people seem to have decided that NPN wasn&amp;#x27;t exactly what they wanted, and they invented a new mechanism called ALPN.&lt;p&gt;Looking at the spec for NPN and knowing about ALPN from implementing just enough of if to enable TLS false start way back when, ALPN is better because it&amp;#x27;s less steps.&lt;p&gt;With ALPN, the client includes its supported protocols in the Client Hello, and the server picks one or discards the extension in the Server Hello. With NPN, the client indicates it supports NPN in the Client Hello, the server sends back a list of supported protocols in the Server Hello, and the client sends an extra message to indicate its selection between change cipher spec and finished.&lt;p&gt;There&amp;#x27;s perhaps more client profiling information on the wire with ALPN, but it&amp;#x27;s not very interesting when 99% of connections just advertise h2,http&amp;#x2F;1.1. During the development of http&amp;#x2F;2, you could probably have a pretty tight range on client versions depending on what pre-standard versions were declared.</text></comment>