Cache timing vulnerability in RSA Key Generation (CVE-2018-0737)

[anonimal]

This is for our static release builds, regarding our usage of libunbound (RSA/SHA1 required for DNSSEC). RSA also needed for epee(?), and more(?) (? = can @moneromooo-monero or @hyc or others confirm?):

https://www.openssl.org/news/secadv/20180416.txt

Due to the low severity of this issue we are not issuing a new release of
OpenSSL 1.1.0 or 1.0.2 at this time. The fix will be included in OpenSSL 1.1.0i
and OpenSSL 1.0.2p when they become available.

If the next point release is not before they release 1.1.0i / 1.0.2p, then we should release a monero point release with those applicable versions once they are released.

[hyc]

Only libunbound had any particular OpenSSL requirement.

[fluffypony]

Yes - only needed for libunbound

[anonimal]

1.1.0i was released August 14th. The static release binaries should be built against the latest version of openssl.

[anonimal]

Should be resolved in the v0.13 series.