Widespread OpenSSL Error-Handling Bugs: A Developer Points to a Systemic Problem

A developer who runs the blog jak-linux.org has published a piece about a pervasive problem: incomplete error handling when using the OpenSSL library.

By his account, this is not a matter of isolated oversights in particular programs, but a widespread practice found across a large number of projects that rely on this cryptographic library.

The heart of the problem

The author notes that many developers who integrate OpenSSL into their applications fail to pay proper attention to correctly checking and handling the error codes returned by the library's functions. This approach can lead to failures in cryptographic operations going unnoticed or being handled incorrectly.

The scale of the phenomenon

The author of the piece stresses that this kind of carelessness amounts to a “pandemic” — that is, it is so widespread that it affects a significant portion of the software ecosystem that depends on OpenSSL for encryption and other cryptographic functions.

The publication sparked discussion in the developer community, where readers shared their own experiences of running into similar shortcomings across various projects.

The author does not offer a specific list of vulnerable programs, instead focusing on the nature of the problem itself and the need for a more careful approach to error handling when working with cryptographic libraries in general.

Source: Lobsters