LibreSSL

From Infogalactic: the planetary knowledge core
Jump to: navigation, search
LibreSSL
192px
Puffy, the mascot of OpenBSD, made to resemble Che Guevara
Original author(s) The OpenSSL Project
Developer(s) The OpenBSD Project
Initial release 2.0.0 / 11 July 2014; 9 years ago (2014-07-11)
Stable release 2.3.4 (May 3, 2016; 8 years ago (2016-05-03)[1]) [±]
2.2.7 (May 3, 2016; 8 years ago (2016-05-03)[1]) [±]
Preview release 2.3.2 (January 28, 2016; 8 years ago (2016-01-28)[2]) [±]
Development status Active
Written in C and assembly
Operating system OpenBSD, FreeBSD, NetBSD, Linux, HP-UX, Solaris, OS X, Windows and others[3]
Type Security library
License Apache license 1.0, 4-clause BSD License, ISC license, and some are public domain
Website www.libressl.org

LibreSSL is an open-source implementation of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. It was forked from the OpenSSL cryptographic software library in April 2014 as a response by OpenBSD developers to the Heartbleed security vulnerability in OpenSSL,[4][5][6][7] with the aim of refactoring the OpenSSL code so as to provide a more secure implementation.[8]

LibreSSL was forked from the OpenSSL library starting with the 1.0.1g branch and will follow the security guidelines used elsewhere in the OpenBSD project.[9]

History

After the Heartbleed bug in OpenSSL, the OpenBSD team audited the code afresh, and quickly realised they would need to maintain a fork themselves.[4] The libressl.org domain was registered on 11 April 2014; the project announced the name on 22 April 2014.

In the first week of code pruning, more than 90,000 lines of C code were removed.[8][10] Older or unused code has been removed, and support for some older or now-rare operating systems removed. LibreSSL was initially being developed as an intended replacement for OpenSSL in OpenBSD 5.6, and was then ported back to other platforms once a stripped-down version of the library was stable.[11][12] As of April 2014, the project was seeking a "stable commitment" of external funding.[10]

On 17 May 2014, Bob Beck presented "LibreSSL: The first 30 days, and what the Future Holds" during the 2014 BSDCan conference, in which he described the progress made in the first month, encountered issues, and implemented changes.[13]

On 5 June 2014, several OpenSSL bugs became public. While several projects were notified in advance,[14] LibreSSL was not; Theo de Raadt accused the OpenSSL developers of intentionally withholding this information from OpenBSD and LibreSSL.[15]

On 20 June 2014, Google created another fork of OpenSSL called BoringSSL, and promised to exchange fixes with LibreSSL.[16][17] Google has already relicensed some of its contributions under the ISC license, as it was requested by the LibreSSL developers.[16][18] On 21 June, Theo de Raadt welcomed BoringSSL and outlined the plans for LibreSSL-portable.[19] Starting on 8 July, code porting for OS X and Solaris began,[20] while the initial porting to Linux began on 20 June.[21]

Version 2.0

On 11 July 2014, the first portable version of LibreSSL was released as version 2.0.0.[22][23] The first release was quickly followed by 2.0.1[24] on 13 July, 2.0.2[25] on 16 July, 2.0.3[26] on 22 July, 2.0.4[27] on 3 August and 2.0.5[28] on 5 August 2014. Many issues with the first portable release were fixed in the 2.0 series.

On 28 September 2014, Ted Unangst presented "LibreSSL: More Than 30 Days Later", in which he described the progress, issues and changes in the months since Bob Beck's BSDCan talk.[13][29]

Version 2.1

With the version 2.1.0,[30] released on 12 October 2014, the rate of changes in LibreSSL became considerably lower and LibreSSL became a usable alternative to OpenSSL. Most of the changes in the 2.1.x versions were related to security vulnerabilities found in OpenSSL.

Version 2.2

Version 2.2.0[31] was released on June 11, 2015 and introduces a preview of a new shared library libtls which aims to provide an easier to use API for SSL/TLS with default secure options. Other additions include AIX and Cygwin support. As usual simplifications and bugfixes are part of the release, many as a result of coverity scanning.

Notable changes in version 2.2 include disabling of SSLv3 and addition of the OPENSSL_NO_EGD flag which is the default for OpenSSL 1.1.0 as well.

Version 2.3

Version 2.3.0[32] was released on September 23, 2015 and marks the complete removal of SSLv3.

Other notable changes in version 2.3 are the removal of SHA-0 which was withdrawn shortly after publication. A new application nc is added which is the OpenBSD netcat implementation with added TLS capability using LibreSSL's libtls library.

Adoption

LibreSSL has been the default provider of TLS for:

Changes

Memory-related

In more detail, some of the more notable and important changes thus far include replacement of custom memory calls to ones in a standard library (for example, strlcpy, calloc, asprintf, reallocarray, etc.).[39][40] This process may help later on to catch buffer overflow errors with more advanced memory analysis tools or by simply observing program crashes (via ASLR, use of the NX bit, stack canaries, etc.).

Fixes for potential double free scenarios have also been cited in the CVS commit logs (including explicit assignments of NULL pointer values).[41] There have been extra sanity checks also cited in the commit logs related to ensuring length arguments, unsigned-to-signed variable assignments, pointer values, and method returns.

Proactive measures

In order to maintain good programming practice, a number of compiler options and flags designed for safety have been enabled by default to help in spotting potential issues so they can be fixed earlier (-Wall, -Werror, -Wextra, -Wuninitialized). There have also been code readability updates which help future contributors in verifying program correctness (KNF, white-space, line-wrapping, etc.). Modification or removal of unneeded method wrappers and macros also help with code readability and auditing (Error and I/O abstraction library references).

Changes were made to ensure that LibreSSL will be year 2038 compatible along with maintaining portability for other similar platforms. In addition, explicit_bzero and bn_clear calls were added to prevent the compiler from optimizing them out and prevent attackers from reading previously allocated memory.

Cryptographic

There were changes to help ensure proper seeding of random number generator-based methods via replacements of insecure seeding practices (taking advantage of features offered by the kernel itself natively).[42][43] In terms of notable additions made, OpenBSD has added support for newer and more reputable algorithms (ChaCha stream cipher and Poly1305 message authentication code) along with a safer set of elliptic curves (brainpool curves from RFC 5639, up to 512 bits in strength).

Added features

The initial release of LibreSSL added a number of features: the ChaCha and Poly1305 algorithm, the Brainpool and ANSSI elliptic curves, and the AES-GCM and ChaCha20-Poly1305 AEAD modes.

Later versions added the following:[44]

  • 2.1.0: Automatic ephemeral EC keys[30]
  • 2.1.2: Built-in arc4random implementation on OS X and FreeBSD[45]
  • 2.1.2: Reworked GOST cipher suite support
  • 2.1.3: ALPN support[46]
  • 2.1.3: SHA-256 Camellia cipher suites
  • 2.1.4: TLS_FALLBACK_SCSV server-side support[47]
  • 2.1.4: certhash as a replacement of the c_rehash script
  • 2.1.4: X509_STORE_load_mem API for loading certificates from memory (enhance chroot support)
  • 2.1.4: Experimental Windows binaries
  • 2.1.5: Minor update mainly for improving Windows support, first working 32- and 64-bit binaries[48]
  • 2.1.6: libtls declared stable and enabled by default[49]
  • 2.2.0: AIX and Cygwin support[31]
  • 2.2.1: Addition of EC_curve_nid2nist and EC_curve_nist2nid[50] from OpenSSL, initial Windows XP/2003 support
  • 2.2.2: Defines LIBRESSL_VERSION_NUMBER,[51] added TLS_*methods as a replacement for the SSLv23_*method calls, cmake build support.

Old insecure features

The initial release of LibreSSL disabled a number of features by default.[33] Some of the code for these features was later removed, including Kerberos, US-Export ciphers, TLS compression, DTLS heartbeat, and SSL v2.

Later versions disabled more features:

  • 2.1.1: Following the discovery of the POODLE vulnerability in the legacy SSL 3.0 protocol, LibreSSL now disables the use of SSL 3.0 by default.[52]
  • 2.1.3: GOST R 34.10-94 signature authentication[44][46]
  • 2.2.1: Removal of Dynamic Engine and MDC-2DES support[50]
  • 2.2.2: Removal of SSLv3 from the openssl binary, removal of Internet Explorer 6 workarounds, RSAX engine.[51]
  • 2.3.0: Complete removal of SSLv3, SHA-0 and DTLS1_BAD_VER

Code removal

The initial release of LibreSSL has removed a number of features that were deemed insecure, unnecessary or deprecated as part of OpenBSD 5.6[33]

  • In response to Heartbleed, the heartbeat functionality[53] was one of the first features to be removed
  • Unneeded platforms (Classic Mac OS, NetWare, OS/2, VMS, 16-bit Windows, etc.)
  • Support for platforms that do not exist, such as big-endian i386 and amd64[54]
  • Support for old compilers
  • The IBM 4758, Broadcom ubsec, Sureware, Nuron, GOST, GMP, CSwift, CHIL, CAPI, Atalla and AEP engines were removed due to irrelevance of hardware or dependency on non-free libraries
  • The OpenSSL PRNG was removed (and replaced with ChaCha20-based implementation of arc4random)
  • Preprocessor macros that have been deemed unnecessary or insecure or were already deprecated in OpenSSL for a long time (e.g. des_old.h)
  • Older unneeded files for assembly language, C, and Perl (e.g. EGD)
  • MD2, SEED functionality
  • SSLv3, SHA-0, DTLS1_BAD_VER

The Dual_EC_DRBG algorithm, which is suspected of having a back door,[55] was cut along with support for the FIPS 140-2 standard that required it. Unused protocols and insecure algorithms have also been removed, including the support for FIPS 140-2,[56] MD4/MD5[44] J-PAKE,[33] and SRP.[27]

Bug backlog

One of the complaints of OpenSSL was the number of open bugs reported in the bug tracker that had gone unfixed for years. Older bugs are now being fixed in LibreSSL.[57]

Security and vulnerabilities

LibreSSL has proven not to be vulnerable to some of the issues discovered after it was forked from the OpenSSL project.

Total vulnerabilities between the release of LibreSSL and the release of OpenSSL 1.0.2:

Severity LibreSSL OpenSSL
Critical 0 0
High 3 3
Medium 9 12
Low 6 6
Total 18 21

Since the release of OpenSSL 1.0.2

Severity LibreSSL OpenSSL
1.0.1 1.0.2
Critical 0 0 0
High 0 2 4
Medium 11 15 20
Low 7 10 11
Unclassified 2 0 0
Total 20 27 35


13 July 2014

Shortly after the first portable release, LibreSSL's PRNG was found to not always reseed the PRNG when forking new processes, and to have low entropy for the seed when /dev/urandom was not available as might happen in a chroot jail.[58] LibreSSL refers to this as the 'Linux forking and PID wrap issue'. This was fixed in LibreSSL 2.0.2.[25]

This vulnerability does not apply to OpenSSL and is a result of the refactoring of the PRNG code in LibreSSL.

CVE reference Description OpenSSL LibreSSL
- (LibreSSL) Linux forking and PID wrap issue not affected Low[lower-alpha 1], fixed

6 August 2014

OpenSSL publishes 9 vulnerabilities[59] and released version 1.0.1i fixing the vulnerabilities. LibreSSL releases version 2.0.5[28] fixing the 6 vulnerabilities that were also found in LibreSSL.

CVE reference Description OpenSSL LibreSSL
CVE-2014-3510 (OpenSSL) Flaw handling DTLS anonymous EC(DH) ciphersuites medium fixed
CVE-2014-3508 (OpenSSL) Information leak in pretty printing functions medium partially vulnerable, fixed
CVE-2014-3509 (OpenSSL) Race condition in ssl_parse_serverhello_tlsext medium fixed
CVE-2014-3505 (OpenSSL) Double Free when processing DTLS packets medium not vulnerable
CVE-2014-3506 (OpenSSL) DTLS memory exhaustion medium fixed
CVE-2014-3507 (OpenSSL) DTLS memory leak from zero-length fragments medium fixed
CVE-2014-3511 (OpenSSL) OpenSSL TLS protocol downgrade attack medium fixed
CVE-2014-5139 (OpenSSL) Crash with SRP ciphersuite in Server Hello message medium Fixed in 2.0.4 by removing code during the embargo
CVE-2014-3512 (OpenSSL) SRP buffer overrun high Fixed in 2.0.4 by removing code during the embargo [60]

15 October 2014

OpenSSL responds to the POODLE attack, publishes 4 vulnerabilities[61] and releases version 1.0.1j with fixes for these vulnerabilities. LibreSSL releases version 2.1.1.

CVE reference Description OpenSSL LibreSSL
CVE-2014-3568 (OpenSSL) Build option no-ssl3 is incomplete low Fixed in 2.3.0 (11 months later) by removing all SSLv3 code
CVE-2014-3513 (OpenSSL) SRTP Memory Leak high Fixed in 2.0.2 (3 months earlier)
CVE-2014-3567 (OpenSSL) Session Ticket Memory Leak medium Not vulnerable, fixed before first release
 ? (OpenSSL) SSL 3.0 Fallback protection medium LibreSSL disables SSLv3[62]

Note: LibreSSL reluctantly added TLS_SCSV_FALLBACK in version 2.1.4[47] "for compatibility with various auditor and vulnerability scanners".

8 January 2015

OpenSSL publishes 8 vulnerabilities[63] discovered by the OpenSSL code review and released version 1.0.1k fixing the vulnerabilities. LibreSSL releases 2.1.4[47] with fixes for the CVE's that were applicable to LibreSSL.

CVE reference Description OpenSSL LibreSSL
CVE-2014-8275 (OpenSSL) Certificate fingerprints can be modified low Fixed
CVE-2014-3572 (OpenSSL) ECDHE silently downgrades to ECDH [Client] low Fixed
CVE-2014-3570 (OpenSSL) Bignum squaring may produce incorrect results low Fixed
CVE-2015-0205 (OpenSSL) DH client certificates accepted without verification [Server] low Fixed
CVE-2015-0206 (OpenSSL) DTLS memory leak in dtls1_buffer_record moderate Not vulnerable, fixed before first release
CVE-2014-3571 (OpenSSL) DTLS segmentation fault in dtls1_get_record moderate unfixed
CVE-2014-3569 (OpenSSL) no-ssl3 configuration sets method to NULL low Not vulnerable
CVE-2015-0204 (OpenSSL) RSA silently downgrades to EXPORT_RSA (FREAK) [Client] high[64] Fixed in 2.1.2 (a month earlier)

19 March 2015

OpenSSL publishes 14 vulnerabilities[65] discovered by the OpenSSL code review and releases versions 1.0.1m and 1.0.2a with fixes for the vulnerabilities. LibreSSL confirms that 5 of these vulnerabilities apply to LibreSSL as well.[66] notably not CVE-2015-0291 which has the highest possible impact rating for OpenSSL since the code was new in the 1.0.2 branch. LibreSSL released 2.1.6[49] to fix these security issues.

CVE reference Description OpenSSL LibreSSL
CVE-2015-0286 (OpenSSL) Segmentation fault in ASN1_TYPE_cmp moderate Fixed
CVE-2015-0287 (OpenSSL) ASN.1 structure reuse memory corruption moderate Fixed
CVE-2015-0288 (OpenSSL) X509_to_X509_REQ NULL pointer deref moderate Fixed
CVE-2015-0289 (OpenSSL) PKCS7 NULL pointer dereferences moderate Fixed
CVE-2015-0209 (OpenSSL) Use After Free following d2i_ECPrivatekey error low Fixed
CVE-2015-0291 (OpenSSL) ClientHello sigalgs DoS (1.0.2 only) high Affected code is not present
CVE-2015-0207 (OpenSSL) Segmentation fault in DTLSv1_listen (1.0.2 only) moderate Not vulnerable
CVE-2015-0208 (OpenSSL) Segmentation fault for invalid PSS parameters (1.0.2 only) moderate Affected code is not present
CVE-2015-0290 (OpenSSL) Multiblock corrupted pointer (1.0.2 only) moderate Affected code is not present
CVE-2015-0292 (OpenSSL) Base64 decode moderate OpenSSL fixed this 9 months earlier, LibreSSL fixed in 10 months earlier before the first release.
CVE-2015-0293 (OpenSSL) DoS via reachable assert in SSLv2 servers moderate Affected code is not present
CVE-2015-0285 (OpenSSL) Handshake with unseeded PRNG low Not vulnerable (LibreSSL PRNG needs no seeding)
CVE-2015-1787 (OpenSSL) Empty CKE with client auth and DHE (1.0.2 only) moderate Not vulnerable (fixed 8 months earlier, before first release)

11 June 2015

OpenSSL publishes seven vulnerabilities.[67] and releases versions 1.0.1n and 1.0.2b with fixes for the vulnerabilities. LibreSSL confirms that three of these vulnerabilities apply to LibreSSL as well and one is still under review,[31] releases 2.1.7 and 2.2.0.

CVE reference Description OpenSSL LibreSSL
CVE-2015-1788 (OpenSSL) Malformed ECParameters causes infinite loop medium Fixed
CVE-2015-1789 (OpenSSL) Exploitable out-of-bounds read in X509_cmp_time medium Fixed
CVE-2015-1790 (OpenSSL) PKCS7 crash with missing EnvelopedContent medium unfixed
CVE-2015-1792 (OpenSSL) CMS verify infinite loop with unknown hash function medium Fixed
CVE-2015-1791 (OpenSSL) Race condition handling NewSessionTicket low unfixed
CVE-2014-8176 (OpenSSL) Invalid free in DTLS medium Not vulnerable
CVE-2015-4000 (OpenSSL) DHE man-in-the-middle protection (Logjam) medium Fixed in 2.1.5 (3 months earlier)

Note: CVE-2015-4000 was assigned with the second fix for this issue.

9 July 2015

OpenSSL publishes a single vulnerability[68] and releases versions 1.0.1p and 1.0.2d with fixes for the vulnerability. Bob Beck announces[69] that this vulnerability does not apply to LibreSSL.

CVE reference Description OpenSSL LibreSSL
CVE-2015-1793 (OpenSSL) Alternative chains certificate forgery high Not affected

15 October 2015

Qualys publishes a memory leak and buffer overflow vulnerability[70] in all LibreSSL[71] versions prior to 2.2.4. Ted Unangst announced release 2.2.4 of LibreSSL[72] fixing the vulnerabilities.

CVE reference Description OpenSSL LibreSSL
CVE-2015-5333 (LibreSSL) Memory leak in OBJ_obj2txt() not affected fixed
CVE-2015-5334 (LibreSSL) Buffer overflow in OBJ_obj2txt() not affected fixed

3 December 2015

OpenSSL publishes five vulnerabilities.[73] and releases versions 1.0.1q and 1.0.2e with fixes for the vulnerabilities. OpenBSD announced [74] to which they were vulnerable and released[75] 2.2.5 and 2.1.9 containing fixes.

CVE reference Description OpenSSL LibreSSL
CVE-2015-3193 (OpenSSL) BN_mod_exp may produce incorrect results on x86_64 (1.0.2 only) Moderate not affected (recent mistake in OpenSSL)
CVE-2015-3194 (OpenSSL) Certificate verify crash with missing PSS parameter Moderate fixed
CVE-2015-3195 (OpenSSL) X509_ATTRIBUTE memory leak Moderate fixed (Not reachable from TLS/SSL)
CVE-2015-3196 (OpenSSL) Race condition handling PSK identify hint low Fixed in 2.0.1 (PSK code deleted 18 months earlier)
CVE-2015-1794 (OpenSSL) Anon DH ServerKeyExchange with 0 p parameter (1.0.2 only) low not affected

28 January 2016

OpenSSL publishes two vulnerabilities and updates an earlier vulnerability[76] and releases versions 1.0.1r and 1.0.2f with fixes for the vulnerability. LibreSSL releases[77] versions 2.3.2, 2.2.6 and 2.1.10 containing corrections for the two vulnerabilities.

CVE reference Description OpenSSL LibreSSL
CVE-2016-0701 (OpenSSL) DH small subgroups (1.0.2 only) High not affected
CVE-2015-3197 (OpenSSL) SSLv2 doesn't block disabled ciphers Low not affected (SSLv2 code deleted 21 months earlier)
CVE-2015-4000 (OpenSSL) Update on DHE man-in-the-middle protection (Logjam) medium not affected

1 March 2016

On 1 March 2016 the OpenSSL project announced releases 1.0.1s and 1.0.2g addressing several security issues.

CVE reference Description OpenSSL LibreSSL
CVE-2016-0702 (OpenSSL) Side channel attack on modular exponentiation low unfixed
CVE-2016-0703 (OpenSSL) Divide-and-conquer session key recovery in SSLv2 high not affected (SSLv2 deleted 2 years earlier)
CVE-2016-0704 (OpenSSL) Bleichenbacher oracle in SSLv2 moderate not affected (SSLv2 deleted 2 years earlier)
CVE-2016-0705 (OpenSSL) Double free in DSA key parsing low Fixed in 2.0.2 (fixed 2 years earlier)
CVE-2016-0797 (OpenSSL) BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption low fixed
CVE-2016-0798 (OpenSSL) Memory leak in SRP database lookup low Fixed in 2.0.4 (SRP deleted 17 months earlier)
CVE-2016-0799 (OpenSSL) Fix memory issues in BIO_*printf functions low not affected (fixed 2 years earlier)
CVE-2016-0800 (OpenSSL) Cross-protocol attack on TLS using SSLv2 high not affected (SSLv2 deleted 2 years earlier)

See also

Notes

  1. ↑ No official rating for this vulnerability is available, however another PRNG seeding issue, CVE-2015-0285 "Handshake with unseeded PRNG", has been rated as low.

References

  1. ↑ 1.0 1.1 Lua error in package.lua at line 80: module 'strict' not found.
  2. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  3. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  4. ↑ 4.0 4.1 Lua error in package.lua at line 80: module 'strict' not found.
  5. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  6. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  7. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  8. ↑ 8.0 8.1 Lua error in package.lua at line 80: module 'strict' not found.
  9. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  10. ↑ 10.0 10.1 Lua error in package.lua at line 80: module 'strict' not found.
  11. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  12. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  13. ↑ 13.0 13.1 Lua error in package.lua at line 80: module 'strict' not found.
  14. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  15. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  16. ↑ 16.0 16.1 Lua error in package.lua at line 80: module 'strict' not found.
  17. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  18. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  19. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  20. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  21. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  22. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  23. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  24. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  25. ↑ 25.0 25.1 Lua error in package.lua at line 80: module 'strict' not found.
  26. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  27. ↑ 27.0 27.1 Lua error in package.lua at line 80: module 'strict' not found.
  28. ↑ 28.0 28.1 Lua error in package.lua at line 80: module 'strict' not found.
  29. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  30. ↑ 30.0 30.1 Lua error in package.lua at line 80: module 'strict' not found.
  31. ↑ 31.0 31.1 31.2 Lua error in package.lua at line 80: module 'strict' not found.
  32. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  33. ↑ 33.0 33.1 33.2 33.3 Lua error in package.lua at line 80: module 'strict' not found.
  34. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  35. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  36. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  37. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  38. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  39. ↑ Lua error in package.lua at line 80: module 'strict' not found.[self-published source?]
  40. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  41. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  42. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  43. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  44. ↑ 44.0 44.1 44.2 Lua error in package.lua at line 80: module 'strict' not found.
  45. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  46. ↑ 46.0 46.1 Lua error in package.lua at line 80: module 'strict' not found.
  47. ↑ 47.0 47.1 47.2 Lua error in package.lua at line 80: module 'strict' not found.
  48. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  49. ↑ 49.0 49.1 Lua error in package.lua at line 80: module 'strict' not found.
  50. ↑ 50.0 50.1 Lua error in package.lua at line 80: module 'strict' not found.
  51. ↑ 51.0 51.1 Lua error in package.lua at line 80: module 'strict' not found.
  52. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  53. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  54. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  55. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  56. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  57. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  58. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  59. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  60. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  61. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  62. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  63. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  64. ↑ Reclassified from low to high
  65. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  66. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  67. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  68. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  69. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  70. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  71. ↑ OpenSSL does not contain these
  72. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  73. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  74. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  75. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  76. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  77. ↑ Lua error in package.lua at line 80: module 'strict' not found.

External links

Retrieved from "https://infogalactic.com/w/index.php?title=LibreSSL&oldid=722709555"