OpenSSL FREAK exploit patched?

[kcconnor]

Has FileZilla Server been patched for the OpenSSL 1.01 FREAK vulnerability?

http://www.zdnet.com/article/freak-anot ... rity-hole/



Edit to add... related OpenSSL bug is CVE-2015-0204.

https://cve.mitre.org/cgi-bin/cvename.c ... -2015-0204

[botg]

FileZilla Server uses OpenSSL 1.0.2 and as such is not vulnerable to this exploit.

[Lejon]

In which version did the OpenSSL 1.0.2 get implemented? We currently run the 0.9.46 beta which included OpenSSL 1.0.1h. One of the articles in the above original inquiry notes that beta versions of OpenSSL 1.0.2 are also susceptible to this attack. Is the current release of FileZilla Server running the latest version of OpenSSL 1.0.2 in which the fix is in place?

[botg]

Yes, the latest version uses OpenSSL 1.0.2

Note that outdated versions of FileZilla or FileZilla Server are entirely unsupported. Please update immediately if you use any outdated version.