[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH 0/1] curl: Fix CVE-2016-3739.
From: |
Ludovic Courtès |
Subject: |
Re: [PATCH 0/1] curl: Fix CVE-2016-3739. |
Date: |
Sun, 12 Jun 2016 22:51:14 +0200 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) |
Leo Famulari <address@hidden> skribis:
> If your SSL / TLS provider is mbedTLS (formerly PolarSSL), there is a
> bug in curl [CVE-2016-3739] that allows an attacker to bypass the full
> certificate check by presenting any valid certificate.
>
> So, you might think are connecting to https://example.com, when in fact
> the attacker has a certificate for any other domain.
>
> We don't package mbedTLS, but I still think we should provide the fixed
> source code.
OTOH this will incur additional grafting for no reason, WDYT?
Thanks,
Ludo’.
- [PATCH 0/1] curl: Fix CVE-2016-3739., Leo Famulari, 2016/06/11
- [PATCH 1/1] gnu: curl: Replace with 7.49.1 [fixes CVE-2016-3739]., Leo Famulari, 2016/06/11
- Re: [PATCH 0/1] curl: Fix CVE-2016-3739.,
Ludovic Courtès <=
- Re: [PATCH 0/1] curl: Fix CVE-2016-3739., ng0, 2016/06/12
- Re: [PATCH 0/1] curl: Fix CVE-2016-3739., Leo Famulari, 2016/06/12
- Re: [PATCH 0/1] curl: Fix CVE-2016-3739., Ludovic Courtès, 2016/06/13
- Re: [PATCH 0/1] curl: Fix CVE-2016-3739., ng0, 2016/06/13
- Re: [PATCH 0/1] curl: Fix CVE-2016-3739., Leo Famulari, 2016/06/13
- Re: [PATCH 0/1] curl: Fix CVE-2016-3739., ng0, 2016/06/13
- Re: [PATCH 0/1] curl: Fix CVE-2016-3739., Leo Famulari, 2016/06/13