Date: Fri, 17 Sep 2010 15:04:02 +0200 From: Tomas Hoger <thoger@...hat.com> To: oss-security@...ts.openwall.com Cc: Hanno Böck <hanno@...eck.de> Subject: Re: CVE request: epiphany not checking ssl certs On Fri, 17 Sep 2010 14:19:03 +0200 Hanno Böck wrote: > http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=564690 > http://blog.fefe.de/?ts=b26ca29d > > Did this get a CVE yet? Any specific reason to only give CVE to epiphany if you want to start giving CVEs for this kind of flaw? IIRC, not long ago, no WebKitGtk-based browser I tried verified server SSL certificates and all connected without any complaint or indication that SSL certificate was not verified. None seemed to offer any configuration option to enable certificate checking. I guess there may be / was some limitations on WebKitGtk side that can explain this. I noticed midori now uses different address bar background color, which seem to be similar to the epiphany fix described in the Debian bug. Oh, now I see you're probably asking for CVE for post-deb#564690 behavior, not pre-deb#564690, right? -- Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ