Image via Wikipedia You might recall my previous article where I wrote:
Personally, I think it’s just spreading FUD; but Information Week is reporting that “Just over a week ago, security researcher Mike Perry presented information at the DEFCON security conference about a vulnerability that affects many SSL-secured Web sites, including Amazon, Facebook, Gmail, addons.mozilla.org, most Drupal sites, and many online merchants and banks. ”In the eyes of Robin Monks, Aug 2008
You should read the whole article if you havn’t already. Back? OK! So, after a call for some dev comments on the issue (thanks to John Wilkins and Christefano for the heads-up!), I can safely say this issue is fixed in DRUPAL-6 branch, HEAD, and about to be fixed in DRUPAL-5. So the fix will be in the next security release of Drupal 5 and 6, and also in Drupal 7. Go go Drupal devs!
Other cool stuff:
![Reblog this post [with Zemanta]](http://img.zemanta.com/reblog_e.png?x-id=3a413dfa-33ea-44f5-b346-aa688827fe3a)
[...] Go to the author’s original blog: Are HTTPS Drupal sites insecure? Not anymore! [...]