A kind reminder we would like all registered users to weigh in on one of our forum's security policies.
Please take a moment to read this thread and place a vote.
https://forum.palemoon.org/viewtopic.php?f=17&t=32935
Please take a moment to read this thread and place a vote.
https://forum.palemoon.org/viewtopic.php?f=17&t=32935
OpenSSL 3 critical CVE
Moderators: trava90, athenian200
-
patrick-g
- Hobby Astronomer

- Posts: 23
- Joined: 2020-12-23, 10:49
OpenSSL 3 critical CVE
Hi,
I'm not completely sure to post in the good thread. If not, please move this post where it belongs.
OpenSSL.org has announced that a new version of OpenSSL will be released next Tuesday to fix a critical vulnerability.
The details on this issue seem to be super embargoed but all 3.x versions of OpenSSL are affected.
I saw that OpenSSL3 is embedded in Linux version of Pale Moon and Basilisk.
Will there be bugfixe releases of the two browsers in the near future?
I'm not completely sure to post in the good thread. If not, please move this post where it belongs.
OpenSSL.org has announced that a new version of OpenSSL will be released next Tuesday to fix a critical vulnerability.
The details on this issue seem to be super embargoed but all 3.x versions of OpenSSL are affected.
I saw that OpenSSL3 is embedded in Linux version of Pale Moon and Basilisk.
Will there be bugfixe releases of the two browsers in the near future?
-
jobbautista9
- Board Warrior

- Posts: 1085
- Joined: 2020-11-03, 06:47
- Location: Philippines
Re: OpenSSL 3 critical CVE
I don't think our platform uses OpenSSL. We might have some OpenSSL code in the platform, but they're most likely disabled at compile-time. We use NSS as our cryptographic library just as Mozilla does.

Tired of creating stuff!
Avatar artwork by Shinki669: https://www.pixiv.net/artworks/113645617
XUL add-ons developer. You can find a list of add-ons I manage at http://rw.rs/~job/software.html.
-
patrick-g
- Hobby Astronomer

- Posts: 23
- Joined: 2020-12-23, 10:49
Re: OpenSSL 3 critical CVE
Hi jobbautista9,
Well, it seems to be fairly used
:
Maybe it's not in the platform but in the applications them selves
Well, it seems to be fairly used
-
Moonchild
- Pale Moon guru

- Posts: 38503
- Joined: 2011-08-28, 17:27
- Location: Sweden
Re: OpenSSL 3 critical CVE
Just because we have a libssl3.so library name doesn't mean it's OpenSSL. XD
Does OpenSSL use libssl3 as a library name to begin with? the "3" there is from NSS being version 3.x IIRC. On Windows it's not built shared as a separate .dll (although it technically could be) but all in all it's all still NSS and not OpenSSL.
And no it's not "present but disabled" -- we don't have it, period.
Does OpenSSL use libssl3 as a library name to begin with? the "3" there is from NSS being version 3.x IIRC. On Windows it's not built shared as a separate .dll (although it technically could be) but all in all it's all still NSS and not OpenSSL.
And no it's not "present but disabled" -- we don't have it, period.
"There is no point in arguing with an idiot, because then you're both idiots." - Anonymous
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite
-
jobbautista9
- Board Warrior

- Posts: 1085
- Joined: 2020-11-03, 06:47
- Location: Philippines
Re: OpenSSL 3 critical CVE
It's very similar apparently; OpenSSL uses "libssl", with the version number 3 after the .so extension (so libssl.so.3). And it doesn't help that Debian uses "libssl3" as the package name for OpenSSL's libraries.

Tired of creating stuff!
Avatar artwork by Shinki669: https://www.pixiv.net/artworks/113645617
XUL add-ons developer. You can find a list of add-ons I manage at http://rw.rs/~job/software.html.
-
patrick-g
- Hobby Astronomer

- Posts: 23
- Joined: 2020-12-23, 10:49
Re: OpenSSL 3 critical CVE
Thanks to both of you for your answers.
There are two current LTS versions of OpenSSL supported by openssl.org: version 1.1.x and version 3.x.
Most Linux distrib provide the two versions, named as libssl.so.1.1 and libssl.so.3.
There are also symbolic links libssl.so and libssl3.so pointing to the two libs.
On my distrib, all software pieces still use libssl.so.1.1 (as libssl.so.3 is a complete rewrite of OpenSSL, which was not yet considered to be completely stable at the time of the last major version of the distro).
Only Pale Moon and Basilisk use libssl3.so.
The content of Pale Moon folder confirms that libssl3.so is not NSS3:
But it could be part of NSS module and not linked to openssl, except for the name of the library.
Sorry for the noise.
In any case it's better to be safe than sorry
.
There are two current LTS versions of OpenSSL supported by openssl.org: version 1.1.x and version 3.x.
Most Linux distrib provide the two versions, named as libssl.so.1.1 and libssl.so.3.
There are also symbolic links libssl.so and libssl3.so pointing to the two libs.
On my distrib, all software pieces still use libssl.so.1.1 (as libssl.so.3 is a complete rewrite of OpenSSL, which was not yet considered to be completely stable at the time of the last major version of the distro).
Only Pale Moon and Basilisk use libssl3.so.
The content of Pale Moon folder confirms that libssl3.so is not NSS3:
Sorry for the noise.
In any case it's better to be safe than sorry
-
Moonchild
- Pale Moon guru

- Posts: 38503
- Joined: 2011-08-28, 17:27
- Location: Sweden
Re: OpenSSL 3 critical CVE
No worries. Thanks for being pro-active and asking about it!
"There is no point in arguing with an idiot, because then you're both idiots." - Anonymous
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite