content: I got a reply from OpenSSL regarding the rumours of a severe vulnerability I sent the following message to OpenSSL's bug reporting service. I sent the following email: Possible zeroday exploit Hi, I found someone else's work claiming to have found a severe bug in your code, so I created a reddit thread: https://www.reddit.com/r/linux/comments/5mvnf2/is_openssl_compromised/ And here is a direct link to the other person's work: https://archive.fo/y13zq I also attached the possible bug as an html file, which is just a copy of the direct link. Just as a disclaimer, none of this work is mine. I just found it and am passing it to you guys. Let me know if it turns out to be anything. Thanks! His reply #1: Thank you, we're looking into addressing this (*).  Quite frankly, it looks like a lot of rambling with very little actual content, as several posters in that reddit thread already explained. Cheers, Richard (*) see https://github.com/openssl/openssl/pull/2083, which implements PBKDF2 and a better iteration count than 1. Richard Levitte         levitte@openssl.org OpenSSL Project         http://www.openssl.org/~levitte/ His reply #2: Hi again, it seems that there's an agreement that this report has very little content. I saw on the reddit thread that you made an update where you seem to agree this is largely a hoax, and as previously noticed, I agree with that assessment. I hope that our current focus on github PR 2083 (link above) has everyone happy that we are addressing the problem that has been mentioned through discussions around this rant, i.e. the iteration count and old KDF. Cheers, Richard So at least we helped somewhat: I hope that our current focus on github PR 2083 (link above) has everyone happy that we are addressing the problem that has been mentioned through discussions around this rant, i.e. the iteration count and old KDF. So thank you Richard for treating a small minority with respect trying to help the project.