Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 17 Sep 2010 15:04:02 +0200
From: Tomas Hoger <>
Cc: Hanno Böck <>
Subject: Re: CVE request: epiphany not checking ssl certs

On Fri, 17 Sep 2010 14:19:03 +0200 Hanno Böck wrote:

> Did this get a CVE yet?

Any specific reason to only give CVE to epiphany if you want to start
giving CVEs for this kind of flaw?  IIRC, not long ago, no
WebKitGtk-based browser I tried verified server SSL certificates and
all connected without any complaint or indication that SSL certificate
was not verified.  None seemed to offer any configuration option to
enable certificate checking.  I guess there may be / was some
limitations on WebKitGtk side that can explain this.

I noticed midori now uses different address bar background color, which
seem to be similar to the epiphany fix described in the Debian bug.

Oh, now I see you're probably asking for CVE for post-deb#564690
behavior, not pre-deb#564690, right?

Tomas Hoger / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ