github-starred/barrier

Fork 0

mirror of https://github.com/debauchee/barrier.git synced 2026-05-15 14:16:02 -06:00

[GH-ISSUE #898] Update OpenSSL #715

New issue

Open

opened 2026-05-05 06:59:15 -06:00 by gitea-mirror · 7 comments

gitea-mirror commented

2026-05-05 06:59:15 -06:00

Owner

Originally created by @ccoenen on GitHub (Oct 4, 2020).
Original GitHub issue: https://github.com/debauchee/barrier/issues/898

OpenSSL in ext/openssl hasn't been touched in three years. At the same time, TLS1.2 is currently configured as the maximum version. Judging from the commit messages, it is currently v1.0.2l from may 2017.

I would love to see this updated to a recent version, and especially deactivating TLSv1.0 and TLSv1.1 (maybe even enabling TLSv1.3 along the way).

Also, I believe, references to "SSL" in the user interface should really be updated to say "TLS" as well.

Originally created by @ccoenen on GitHub (Oct 4, 2020). Original GitHub issue: https://github.com/debauchee/barrier/issues/898 OpenSSL in `ext/openssl` hasn't been touched in three years. At the same time, TLS1.2 is currently configured as the maximum version. Judging from the commit messages, it is currently [v1.0.2l from may 2017](https://github.com/openssl/openssl/blob/master/CHANGES.md#changes-between-102k-and-102l-25-may-2017). I would love to see this updated to a recent version, and especially deactivating TLSv1.0 and TLSv1.1 (maybe even enabling TLSv1.3 along the way). Also, I believe, references to "SSL" in the user interface should really be updated to say "TLS" as well.

gitea-mirror commented

2026-05-05 06:59:19 -06:00

Author

Owner

@shymega commented on GitHub (Oct 4, 2020):

OpenSSL is in progress of being updated.

@shymega commented on GitHub (Oct 4, 2020): OpenSSL is in progress of being updated.

gitea-mirror commented

2026-05-05 06:59:21 -06:00

Author

Owner

@shymega commented on GitHub (Oct 4, 2020):

Unfortunately, I can't release anymore information on that front because of the way its been handled. I think I can't anyway... but with the UI part, I think I can push a commit for that :)

EDIT: Just looking at it now though - I can only really edit the English translation for that part of the UI. There's a fair bit of unfinished translations for the SSL text references on the UI, and other elements.

I'll edit the English translation for now.

@shymega commented on GitHub (Oct 4, 2020): Unfortunately, I can't release anymore information on that front because of the way its been handled. I think I can't anyway... but with the UI part, I think I can push a commit for that :) EDIT: Just looking at it now though - I can only really edit the English translation for that part of the UI. There's a fair bit of unfinished translations for the SSL text references on the UI, and other elements. I'll edit the English translation for now.

gitea-mirror commented

2026-05-05 06:59:24 -06:00

Author

Owner

@shymega commented on GitHub (Oct 4, 2020):

Actually, now that I think about it.. I'm not sure if we even use TLS in Barrier. :/

@shymega commented on GitHub (Oct 4, 2020): Actually, now that I think about it.. I'm not sure if we even use TLS in Barrier. :/

gitea-mirror commented

2026-05-05 06:59:26 -06:00

Author

Owner

@shymega commented on GitHub (Oct 4, 2020):

Oops. Yeah, we don't. Should have realised - gonna go close #901, and we can reopen and merge once we have TLS support... sorry for the confusion.

@shymega commented on GitHub (Oct 4, 2020): Oops. Yeah, we don't. Should have realised - gonna go close #901, and we can reopen and merge once we have TLS support... sorry for the confusion.

gitea-mirror commented

2026-05-05 06:59:27 -06:00

Author

Owner

@ccoenen commented on GitHub (Oct 4, 2020):

Actually, now that I think about it.. I'm not sure if we even use TLS in Barrier. :/

My client inists (via log) that it connects via TLS 1.2

connecting to ...
...
"connected to secure socket"
AES256-GCM-SHA384 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(256) Mac=AEAD

I would have assumed that this means it's connected via this cipher suite?

@ccoenen commented on GitHub (Oct 4, 2020): > Actually, now that I think about it.. I'm not sure if we even use TLS in Barrier. :/ My client inists (via log) that it connects via TLS 1.2 ``` connecting to ... ... "connected to secure socket" AES256-GCM-SHA384 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(256) Mac=AEAD ``` I would have assumed that this means it's connected via this cipher suite?

gitea-mirror commented

2026-05-05 06:59:28 -06:00

Author

Owner

@seeu3 commented on GitHub (Nov 2, 2021):

BUMP!

Update OpenSSL #898

MAIN request:
-update OPENSSL to the current version. (current versions are 1.1.1L, or the new 3.0.0 branch)
reason: multiple vulnerabilities have been patched since OpenSSL 1.0.2L 25 May 2017
example: https://www.cybersecurity-help.cz/vulnerabilities/56064/
solution1 : update the codebase to use a new version of openssl
solution2 : inform users of each vulnerability, and/or perhaps recommend stunnel for encrypted traffic.

Other requests:
-deactivate TLSv1.0 and TLSv1.1 (and TLSv1.2?)
-references to "SSL" in the user interface should really be updated to say "TLS" as well

Please, at your earliest convenience, address the main request.
Much appreciated.

@seeu3 commented on GitHub (Nov 2, 2021): BUMP! Update OpenSSL #898 MAIN request: -update OPENSSL to the current version. (current versions are 1.1.1L, or the new 3.0.0 branch) reason: multiple vulnerabilities have been patched since OpenSSL 1.0.2L 25 May 2017 example: https://www.cybersecurity-help.cz/vulnerabilities/56064/ solution1 : update the codebase to use a new version of openssl solution2 : inform users of each vulnerability, and/or perhaps recommend stunnel for encrypted traffic. Other requests: -deactivate TLSv1.0 and TLSv1.1 (and TLSv1.2?) -references to "SSL" in the user interface should really be updated to say "TLS" as well Please, at your earliest convenience, address the main request. Much appreciated.

gitea-mirror commented

2026-05-05 06:59:29 -06:00

Author

Owner

@shymega commented on GitHub (Nov 3, 2021):

It's being discussed... can't say too much on it. I recognise it is insecure though. I have worked on a CMake patch for it. Ideally, I don't want OpenSSL bundled, as it ends up being unmaintained.

@shymega commented on GitHub (Nov 3, 2021): It's being discussed... can't say too much on it. I recognise it is insecure though. I have worked on a CMake patch for it. Ideally, I don't want OpenSSL bundled, as it ends up being unmaintained.

No labels

Rows
Columns