# OpenSSL security issue affecting Bro **URL:** \ **Category:** Zeek\ **Created:** [December 3, 2015, 8:01pm UTC](https://community.zeek.org/t/openssl-security-issue-affecting-bro/3930 "2015-12-03T20:01:28Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [December 3, 2015, 8:01pm UTC](https://community.zeek.org/t/openssl-security-issue-affecting-bro/3930/1 "2015-12-03T20:01:28Z")
Hello, The OpenSSL Project today published a security advisory, that affects users of Bro that are using the X.509 certificate validation functionality of Bro. Note that this functionality is not enabled by default - typically it is enabled by either loading the policy script protocols/ssl/validate-certs.bro or protocols/ssl/validate-ocsp.bro. The OpenSSL bug can cause a null-pointer exception when parsing certain malformed X.509 certificates and can potentially be used for DOS attacks. The issue affects OpenSSL 1.0.1 and 1.0.2 and was fixed in OpenSSL 1.0.1q and 1.0.2e respectively. If you use Bro and perform certificate validation, you should update as soon as possible. The original OpenSSL security advisory is available at [https://www.openssl.org/news/secadv/20151203.txt](https://www.openssl.org/news/secadv/20151203.txt). It also contains a few other issues that are not directly applicable to Bro. Johanna ---
**Author:** ![Daniel\_Guerra](https://avatars.discourse-cdn.com/v4/letter/d/b5ac83/32.png) [@Daniel\_Guerra](https://community.zeek.org/u/Daniel_Guerra)\ **Post date:** [December 4, 2015, 9:20am UTC](https://community.zeek.org/t/openssl-security-issue-affecting-bro/3930/2 "2015-12-04T09:20:45Z")
I think the main distro’s are not ready yet! Just got : jessie/main openssl amd64 1.0.1k-3+deb8u1 q is still in testing. ---
**Author:** ![Christian\_Struck](https://avatars.discourse-cdn.com/v4/letter/c/e19adc/32.png) [@Christian\_Struck](https://community.zeek.org/u/Christian_Struck)\ **Post date:** [December 4, 2015, 3:30pm UTC](https://community.zeek.org/t/openssl-security-issue-affecting-bro/3930/3 "2015-12-04T15:30:26Z")
Hi Daniel, ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [December 4, 2015, 11:51pm UTC](https://community.zeek.org/t/openssl-security-issue-affecting-bro/3930/4 "2015-12-04T23:51:03Z")
Hello, we just posted an updated blog post describing the problem to [http://blog.bro.org/2015/12/openssl-security-issue-affecting-bro.html](http://blog.bro.org/2015/12/openssl-security-issue-affecting-bro.html). Please note, that different from the original descriptions, default installations of Bro that use broctl are vulnerable; a quick fix is to not load protocols/ssl/validate-certs.bro in local.bro. The blog post also contains instructions on how to test if your local openssl installation is vulnerable. Johanna ---
**Author:** ![Daniel\_Guerra](https://avatars.discourse-cdn.com/v4/letter/d/b5ac83/32.png) [@Daniel\_Guerra](https://community.zeek.org/u/Daniel_Guerra)\ **Post date:** [December 5, 2015, 2:32pm UTC](https://community.zeek.org/t/openssl-security-issue-affecting-bro/3930/5 "2015-12-05T14:32:00Z")
Hi Johanna, My latest docker project has been fixed for this. I tried your test before and after the update en can confirm it works on debian. Thanx ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/openssl-security-issue-affecting-bro/3930/6 "2022-05-06T15:43:16Z")