[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH 0/1] curl: Fix CVE-2016-3739.
|
From: |
Leo Famulari |
|
Subject: |
Re: [PATCH 0/1] curl: Fix CVE-2016-3739. |
|
Date: |
Sun, 12 Jun 2016 21:12:31 -0400 |
|
User-agent: |
Mutt/1.6.0 (2016-04-01) |
On Sun, Jun 12, 2016 at 09:02:32PM +0000, ng0 wrote:
> On 2016-06-12(10:51:14+0200), Ludovic Courtès wrote:
> > Leo Famulari <address@hidden> skribis:
> >
> > > If your SSL / TLS provider is mbedTLS (formerly PolarSSL), there is a
> > > bug in curl [CVE-2016-3739] that allows an attacker to bypass the full
> > > certificate check by presenting any valid certificate.
> > >
> > > So, you might think are connecting to https://example.com, when in fact
> > > the attacker has a certificate for any other domain.
> > >
> > > We don't package mbedTLS, but I still think we should provide the fixed
> > > source code.
> >
> > OTOH this will incur additional grafting for no reason, WDYT?
No reason for things built within our distribution, true.
> fyi,
>
> mbedtls is on my list of packages to do, as the webserver hiawatha
> depends on it.
>
> Should I announce once it is packaged and the cve fix can be applied
> afterwards?
We should definitely update curl on core-updates-next, or whatever is
built after the current cycle, and we should not add hiawatha until the
fixed curl is in our tree.