oss-security - Re: Re: CVE request: irssi 0.8.15

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 17 Apr 2010 16:37:59 -0500
From: Jamie Strandboge <jamie@...onical.com>
To: Wouter Coekaerts <coekie@...si.org>
Cc: oss-security <oss-security@...ts.openwall.com>, Steve Langasek <steve.langasek@...onical.com>
Subject: Re: Re: CVE request: irssi 0.8.15

FYI,

I backported the following svn commits to 0.8.14 for the SSL issue:
r5104:
  Check if an SSL certificate matches the hostname of the server we are
  connecting to
r5107:
  Use one SSL_CTX per connection, use default trusted CAs if nothing
  specified. This allows useful use of -ssl_verify without
  -ssl_cafile/-ssl_capath, using OpenSSL's default trusted CAs.
r5108:
  Call OpenSSL_add_all_algorithms(), may be needed to verify SHA256
  certs with certain versions of OpenSSL.
r5116:
  network-openssl: Show why a certificate failed validation.
r5136
  Do not use SSLv2 protocol. From Bazerka.

However, after rolling it out Steve Langasek discovered a bug when
connecting to an SSL irc proxy server[1]. His patch (attached) adjusts
it so when we have a proxy setting, expect the CN to match the proxy
hostname, not the server hostname

[1] https://bugs.launchpad.net/ubuntu/+source/irssi/+bug/565182

-- 
Jamie Strandboge             | http://www.canonical.com

View attachment "irssi-565182.diff" of type "text/x-patch" (1185 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.