[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH 0/1] curl: Fix CVE-2016-3739.
From: |
ng0 |
Subject: |
Re: [PATCH 0/1] curl: Fix CVE-2016-3739. |
Date: |
Sun, 12 Jun 2016 21:02:32 +0000 |
On 2016-06-12(10:51:14+0200), Ludovic Courtès wrote:
> Leo Famulari <address@hidden> skribis:
>
> > If your SSL / TLS provider is mbedTLS (formerly PolarSSL), there is a
> > bug in curl [CVE-2016-3739] that allows an attacker to bypass the full
> > certificate check by presenting any valid certificate.
> >
> > So, you might think are connecting to https://example.com, when in fact
> > the attacker has a certificate for any other domain.
> >
> > We don't package mbedTLS, but I still think we should provide the fixed
> > source code.
>
> OTOH this will incur additional grafting for no reason, WDYT?
>
> Thanks,
> Ludo’.
>
fyi,
mbedtls is on my list of packages to do, as the webserver hiawatha
depends on it.
Should I announce once it is packaged and the cve fix can be applied
afterwards?
--
♥Ⓐ ng0
For non-prism friendly talk find me on
psyced.org / loupsycedyglgamf.onion
signature.asc
Description: Digital signature
- [PATCH 0/1] curl: Fix CVE-2016-3739., Leo Famulari, 2016/06/11
- [PATCH 1/1] gnu: curl: Replace with 7.49.1 [fixes CVE-2016-3739]., Leo Famulari, 2016/06/11
- Re: [PATCH 0/1] curl: Fix CVE-2016-3739., Ludovic Courtès, 2016/06/12
- Re: [PATCH 0/1] curl: Fix CVE-2016-3739.,
ng0 <=
- Re: [PATCH 0/1] curl: Fix CVE-2016-3739., Leo Famulari, 2016/06/12
- Re: [PATCH 0/1] curl: Fix CVE-2016-3739., Ludovic Courtès, 2016/06/13
- Re: [PATCH 0/1] curl: Fix CVE-2016-3739., ng0, 2016/06/13
- Re: [PATCH 0/1] curl: Fix CVE-2016-3739., Leo Famulari, 2016/06/13
- Re: [PATCH 0/1] curl: Fix CVE-2016-3739., ng0, 2016/06/13
- Re: [PATCH 0/1] curl: Fix CVE-2016-3739., Leo Famulari, 2016/06/13