Date: Wed, 12 Mar 2014 21:36:10 +1100 From: Michael Samuel <mik@...net.net> To: oss-security@...ts.openwall.com Subject: Re: Re: CVE request: claws-mail vcalendar plugin stores user/password in cleartext On 12 March 2014 20:56, Marcus Meissner <meissner@...e.de> wrote: > Note comment by author(?): > "However, while I agree that CURLOPT_SSL_VERIFYHOST should probably be > enabled, I do not see any usefulness in enabling CURLOPT_SSL_VERIFYPEER. I > do not really buy into the extortion racket that certificate authority > companies run." > For people that take this (somewhat valid) stance WRT CAs, the answer is to retrieve the self-signed certificate and either add it to the system's ca-trust store, or specify CURLOPT_CAINFO with a file containing the self-signed certificate. Note that CURLOPT_CAINFO doesn't do proper pinning - this won't work with a CA-issued certificate unless the CA certificate was in the file too, as the host certificate would contain the CA:false basicConstraint. That CA could issue another certificate for the host and it would be accepted. Disabling SSL_VERIFYPEER is as obviously broken as an inetd service calling gets(). An author's claim that this is fine runs counter to users' expectation that enabling TLS provides security. Regards, Michael
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ