<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> <body text="#000000" bgcolor="#FFFFFF"> Based solely on the CVE information, I'd surmise we aren't affected by CVE-2017-3733, because we don't have any OpenSSL 1.1.0 in the repositories - anywhere. The original Apache announcement also indicated that 1.0.2 is not affected, and the Security Team made a note that only OpenSSL 1.1.x is affected. Since that's what's there, I'm pretty sure there's no need to worry about this CVE with regards to any current Ubuntu releases. Thomas <div class="moz-cite-prefix">On 09/20/2017 06:38 PM, Robie Basak wrote: </div> <blockquote type="cite" cite="mid:20170920223822.GZ8004@mal.justgohome.co.uk"> <pre wrap="">On Tue, Sep 19, 2017 at 03:31:22AM +0000, Eric Yuen wrote: </pre> <blockquote type="cite"> <pre wrap="">I am looking for a contact to reach out in regards <a class="moz-txt-link-freetext" href="https://packages.ubuntu.com/trusty/openssl">https://packages.ubuntu.com/trusty/openssl</a> on Trusty and having an update to the OpenSSL package updated with CVE-2017-3733 </pre> </blockquote> <pre wrap=""> The CVE database reports that Trusty is not affected by CVE-2017-3733: <a class="moz-txt-link-freetext" href="https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-3733.html">https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-3733.html</a> If this is incorrect, please contact the security team: <a class="moz-txt-link-freetext" href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-hardened">https://lists.ubuntu.com/mailman/listinfo/ubuntu-hardened</a> Hope that helps, Robie </pre> <fieldset class="mimeAttachmentHeader"></fieldset> </blockquote> </body> </html>