Date: Sun, 18 Sep 2016 14:31:24 +0200 From: Salvatore Bonaccorso <carnil@...ian.org> To: OSS Security Mailinglist <oss-security@...ts.openwall.com> Subject: CVE Request: GnuTLS: OCSP validation issue (GNUTLS-SA-2016-3) Hi Some days ago new GnuTLS version were released for GNUTLS-SA-2016-3 (OCSP validation issue): > Stefan Bühler discovered an issue that affects validation of > certificates using OCSP responses, which can falsely report a > certificate as valid under certain circumstances. That issue affects > gnutls 3.3.24, 3.4.14, 3.5.3 and previous versions. Write-up by > Stefan Bühler > Recommendation: Upgrade to GnuTLS versions 3.4.15, 3.5.4 or apply the > patch referenced in the mail above. Upstream fix is at . This is as well tracked in Red Hat's bugzilla at . Could you please assign a CVE for this issue? Regards, Salvatore  https://lists.gnupg.org/pipermail/gnutls-devel/2016-September/008146.html  https://gitlab.com/gnutls/gnutls/commit/964632f37dfdfb914ebc5e49db4fa29af35b1de9  https://bugzilla.redhat.com/show_bug.cgi?id=1374266
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ