[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

bug#22202: 24.5; SECURITY ISSUE -- Emacs Server vulnerable to random num

From: Andy Moreton
Subject: bug#22202: 24.5; SECURITY ISSUE -- Emacs Server vulnerable to random number generator attack on Windows systems
Date: Mon, 18 Jan 2016 12:04:34 +0000
User-agent: Gnus/5.13 (Gnus v5.13) Emacs/25.1.50 (windows-nt)

On Sun 17 Jan 2016, Paul Eggert wrote:

> Andreas Schwab discovered a problem with my patch in that GnuTLS wasn't
> initialized, and reverted the GnuTLS part of it. As I understand it, newer
> versions of GnuTLS initialize themselves when they are loaded and so do not
> run into the issue; I tested with GnuTLS 3.3.15, which I suppose is new
> enough. I attempted to fix this problem in the followup commit
> 130d512045aa376333b664d58c501b3884187592.

Your patch will break builds configured using --without-gnutls, as the
gnutls headers may not be installed, and should not be included.

In addition, these changes require static or dynamic linking of gnutls,
which breaks the Windows builds (which use runtime imports for the gnutls DLLs).

> Andreas's commit also changed some unrelated style issues, which I reverted;
> that is merely a longrunning stylistic disagreement, and right now is not a
> good time to be changing style in code unrelated to fixes.

This is rudeness from both of you: please solve this disagreement by
talking to each other instead of adding pointless churn to the source tree.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]