Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Matt Caswell
AI is Finding More Vulnerabilities But Open Source Needs More People to Fix Them
Artificial intelligence is reshaping how security vulnerabilities are discovered and at OpenSSL, we are seeing the impacts first-hand. In 2025, our security address received approximately nine separate reports and enquiries every month and now that number is as high as 70. AI tools can scan source code and flag potential security issues at a scale that once demanded significant time and effort from human experts.
The responsibility gap in open source is getting harder to ignore
By Matt Caswell, Executive Director, OpenSSL Foundation and Principal Software Engineer Most businesses would not expect critical infrastructure to maintain itself. If a company relies on a data center, cloud provider or network connection, somebody owns the relationship. There is a contract, a budget and an understanding of what happens when something goes wrong. Open source often sits in a very different category.
OpenSSL Security Advisory
oss-sec mailing list archives From: Matt Caswell <matt () openssl org> Date: Thu, 25 Jan 2024 18:44:59 +0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenSSL Security Advisory [25th January 2024] ============================================= PKCS12 Decoding crashes (CVE-2024-0727) ======================================= Severity: Low Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary:...
Re: upcoming release of OpenSSL 3.1.4 and 3.0.12
oss-sec mailing list archives From: Matt Caswell <matt () openssl org> Date: Wed, 18 Oct 2023 14:30:22 +0100 On 17/10/2023 19:06, Solar Designer wrote: Matt, I'd appreciate it if you (or your team) would also be posting these to oss-security going forward, roughly at the same time with posting them to your project's public lists. Also, more specific Subject lines on these and on the eventual security advisories would be helpful.
OpenSSL Security Advisory
oss-sec mailing list archives From: Matt Caswell <matt () openssl org> Date: Mon, 31 Jul 2023 15:38:01 +0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenSSL Security Advisory [31st July 2023] ========================================== Excessive time spent checking DH q parameter value (CVE-2023-3817) ================================================================== Severity: Low Issue summary: Checking excessively long DH keys or parameters may be very slow.
OpenSSL Security Advisory
oss-sec mailing list archives From: Tomas Mraz <tomas () openssl org> Date: Tue, 30 May 2023 13:49:33 +0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenSSL Security Advisory [30th May 2023] ========================================= Possible DoS translating ASN.1 object identifiers (CVE-2023-2650) ================================================================= Severity: Moderate Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be...
OpenSSL 3.1 Final Release
RSS , We are pleased to announce that the forthcoming OpenSSL 3.1 release is to be made available on 14th March 2023. OpenSSL 3.1 is mostly a small increment over the functionality available in OpenSSL 3.0. The main changes are: A FIPS 140-3 compliant FIPS Provider. The FIPS provider has been upgraded to be FIPS 140-3 compliant. We are working with our FIPS lab to submit our FIPS 140-3 validation to CMVP based on the 3.1.0 release.
UAF in OpenSSL up to 3.0.7
oss-sec mailing list archives From: Octavio Galland <octavio.galland () gmail com> Date: Thu, 2 Mar 2023 23:24:00 -0300 Hi all, There is a heap-based UAF vulnerability in OpenSSL up to version 3.0.7 (note that it affected version branches 1.0 and 1.1 as well). I include the report that was sent to the OpenSSL security team, with an update concerning reproducibility.
OpenSSL Security Advisory
OpenSSL openssl at openssl.org Tue Feb 7 16:32:29 UTC 2023 Previous message (by thread): OpenSSL version 3.0.8 published Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 OpenSSL Security Advisory [7th February 2023] ============================================= X.400 address type confusion in X.509 GeneralName (CVE-2023-0286) ================================================================= Severity: High There is a type confusion...
OpenSSL Blog
, The OpenSSL Technical Committee (OTC) was recently made aware of several potential attacks against the OpenSSL libraries which might permit information leakage via the Spectre attack.1 Although there are currently no known exploits for the Spectre attacks identified, it is plausible that some of them might be exploitable. Local side channel attacks, such as these, are outside the scope of our security policy, however the project generally does introduce mitigations when they are discovered.
OpenSSL 3.0 Has Been Released!
After 3 years of development work, 17 alpha releases, 2 beta releases, over 7,500 commits and contributions from over 350 different authors we have finally released OpenSSL 3.0! In addition to this there has been a large number of contributions from our users who have been actively working with the pre-release versions to test it, make sure it works in the real world and with a large array of different applications and reporting their results.
OpenSSL 3.0 Release Candidate
The OpenSSL Management Committee (OMC) and the OpenSSL Technical Committee (OTC) are glad to announce our first beta release of OpenSSL 3.0. We consider this to be a release candidate and as such encourage all OpenSSL users to build and test against this beta release and provide feedback. A lot of work has been going on over the last few months getting OpenSSL 3.0 ready for its final release.
OpenSSL Is Looking for a Full Time Administrator and Manager
The OpenSSL Management Committee are looking to hire a full time Administrator and Manager. Details of the role follow. To apply please send your cover letter and resume to jobs@openssl.org by 20th September 2020. OpenSSL Administrator and Manager The OpenSSL Administrator and Manager will report to the OpenSSL Management Committee (OMC).
The Holy Hand Grenade of Antioch
The OpenSSL Management Committee has been looking at the versioning scheme that is currently in use. Over the years we’ve received plenty of feedback about the “uniqueness” of this scheme, and it does cause some confusion for some users. We would like to adopt a more typical version numbering approach.
OpenSSL 1.1.1 Is Released
After two years of work we are excited to be releasing our latest version today - OpenSSL 1.1.1. This is also our new Long Term Support (LTS) version and so we are committing to support it for at least five years. OpenSSL 1.1.1 has been a huge team effort with nearly 5000 commits having been made from over 200 individual contributors since the release of OpenSSL 1.1.0. These statistics just illustrate the amazing vitality and diversity of the OpenSSL community.
OpenSSL Wins the Levchin Prize
Today I have had great pleasure in attending the Real World Crypto 2018 conference in Zürich in order to receive the Levchin prize on behalf of the OpenSSL team. The Levchin prize for Real World Cryptography recognises up to two groups or individuals each year who have made significant advances in the practice of cryptography and its use in real-world systems. This year one of the two recipients is the OpenSSL team. The other recipient is Hugo Krawczyk.
NFLer Implies ‘Urinating Like a Dog’ TD Celebration Was Directed at Trump
New York Giants star wide receiver Odell Beckham Jr. hinted Monday that his touchdown celebration where he pretended to urinate in the Philadelphia Eagles end zone was a response to President Trump calling players who kneel for the National Anthem “sons of b****es . Beckham responded to a tweet that questioned whether the move was in response to the president’s remarks on Sunday, saying “If u seen that, I have to tip my hat to u for thinkin outside the box.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Matt
Contact Matt, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack