guix-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: GnuTLS security update


From: Vincent Legoll
Subject: Re: GnuTLS security update
Date: Sun, 11 Sep 2016 18:08:27 +0200

On Sun, Sep 11, 2016 at 5:41 PM, Leo Famulari <address@hidden> wrote:
> There is a GnuTLS security advisory [0] regarding "an issue that affects
> validation of certificates using OCSP responses, which can falsely
> report a certificate as valid under certain circumstances."
>
> I updated GnuTLS on core-updates to 3.5.4, the latest release of the 3.5
> series.
>
> For master, the naive approach of cherry-picking the patch [1] did not
> work; the test 'system-prio-file' fails consistently with that change. I
> could instead try grafting the updated version.
>
> What do you think? The authors seem to think it's a relatively minor
> issue [2], since exploiting it requires an attacker to compromise the
> certificate authority.

Side questions (just for my curiosity's sake):

- What does it cost (manpower, hydra build time, etc...) approximatively
to do a new release ?

- Is it sufficiently automated ?
- Can we help ?

-- 
Vincent Legoll



reply via email to

[Prev in Thread] Current Thread [Next in Thread]