[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH 0/1] curl: Fix CVE-2016-3739.
From: |
Ludovic Courtès |
Subject: |
Re: [PATCH 0/1] curl: Fix CVE-2016-3739. |
Date: |
Mon, 13 Jun 2016 17:07:23 +0200 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) |
Leo Famulari <address@hidden> skribis:
> On Sun, Jun 12, 2016 at 09:02:32PM +0000, ng0 wrote:
>> On 2016-06-12(10:51:14+0200), Ludovic Courtès wrote:
>> > Leo Famulari <address@hidden> skribis:
>> >
>> > > If your SSL / TLS provider is mbedTLS (formerly PolarSSL), there is a
>> > > bug in curl [CVE-2016-3739] that allows an attacker to bypass the full
>> > > certificate check by presenting any valid certificate.
>> > >
>> > > So, you might think are connecting to https://example.com, when in fact
>> > > the attacker has a certificate for any other domain.
>> > >
>> > > We don't package mbedTLS, but I still think we should provide the fixed
>> > > source code.
>> >
>> > OTOH this will incur additional grafting for no reason, WDYT?
>
> No reason for things built within our distribution, true.
Right.
>> fyi,
>>
>> mbedtls is on my list of packages to do, as the webserver hiawatha
>> depends on it.
>>
>> Should I announce once it is packaged and the cve fix can be applied
>> afterwards?
>
> We should definitely update curl on core-updates-next, or whatever is
> built after the current cycle, and we should not add hiawatha until the
> fixed curl is in our tree.
Agreed on both points. Can you already push the curl update in
core-updates-next?
Though I would like the default curl package to still used GnuTLS. So I
think curl-with-mbedtls will be a different package anyway.
Thanks,
Ludo’.