Date: Mon, 17 Mar 2014 15:16:12 +0100 (CET) From: Daniel Stenberg <daniel@...x.se> To: oss-security@...ts.openwall.com Subject: CVE request: flaw in curl's Windows SSL backend Hi I'd like to ask for a CVE for a newly discovered problem in curl's functionality that verifies server certificates. The problem is present in code only runnning on Windows when using the schannel SSL backend. It is very similar to the Mac-specific curl problem Apple registered CVE-2014-1263 for, but for another backend and platform. I don't think it is a good idea to "pile up" another bug on an existing CVE so a new one is probably needed. For this reason, I do not request this on distros@ or linux-distros@ since this problem does not affect any opensource distro. This is for an open source product executing on Windows. We intend to announce the full details in sync the pending curl release on March 26. -- / daniel.haxx.se
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ