Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 17 Mar 2014 15:16:12 +0100 (CET)
From: Daniel Stenberg <daniel@...x.se>
To: oss-security@...ts.openwall.com
Subject: CVE request: flaw in curl's Windows SSL backend

Hi

I'd like to ask for a CVE for a newly discovered problem in curl's 
functionality that verifies server certificates. The problem is present in 
code only runnning on Windows when using the schannel SSL backend. It is very 
similar to the Mac-specific curl problem Apple registered CVE-2014-1263 for, 
but for another backend and platform.

I don't think it is a good idea to "pile up" another bug on an existing CVE so 
a new one is probably needed.

For this reason, I do not request this on distros@ or linux-distros@ since 
this problem does not affect any opensource distro. This is for an open source 
product executing on Windows.

We intend to announce the full details in sync the pending curl release on 
March 26.

-- 

  / daniel.haxx.se

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ