OpenSSL version 4 point 1 point 0 adds DTLS 1 point 3 with four known bugs

The OpenSSL project released version 4.1.0, adding support for Datagram Transport Layer Security version 1.3. Help Net Security reported that the new release includes four known bugs in the DTLS code. DTLS 1.3 provides encryption for datagram transports such as UDP and is defined in RFC 9147. [1]

Help Net Security reported that the four known bugs can stall connections, drop session tickets, or abort server handshakes. Developers who adopt DTLS 1.3 or use the newly added DTLS support in OpenSSL's SSL listener API are affected. Two of the bugs can cause an application to misread the state of a connection. Additionally, a permanent receive failure on a DTLS listener can show up as the SSL_ERROR_WANT_READ error code. [1]

OpenSSL is a software library for applications that provides secure communications over computer networks against eavesdropping and identifies parties at each end. It is widely used by internet servers, including the majority of HTTPS websites. The project originated in 1998 as a collaborative continuation of the SSLeay library, which Eric A. Young and Tim J. Hudson developed in 1995 to provide free encryption tools. [2][3]

The first official OpenSSL release, version 0.9.1c, was made available on December 23, 1998. Over the years, OpenSSL has evolved through major versions, including the long supported 1.0.x and 1.1.x series, as well as version 3.0 in September 2021. [3]