oss-security - Re: CVE ID request: GNUTLS

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Tue, 20 May 2008 07:55:19 +0200
From: Simon Josefsson <simon@...efsson.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE ID request: GNUTLS

Jonathan Smith
<smithj-TzNcu2uxYW0shl4onS21xdBPR1lH4CV8@...lic.gmane.org> writes:

> Florian Weimer wrote:
> | Several issues have been announced in GNUTLS-SA-2008-1:
>
> Note that the fixed versions has changed. 2.2.4 didn't fix the issue, so
> they pushed 2.2.5 today as well.
>
> reference
> http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2812

Actually, v2.2.4 did fix the security issue.

However, the code to detect and print a debug message about the attack
was buggy and was triggered for normal connections under some conditions
(conditions which, alas, the self-tests did not exercise).

Still, the 2.2.5 announcement is what you want to read to get the full
picture.  Note that gmane garbles OpenPGP signed cleartext patches.  Try
this link instead:

http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00060.html

/Simon

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.