Date: Thu, 03 Nov 2016 17:26:27 +0100 From: Florian Weimer <fw@...eb.enyo.de> To: oss-security@...ts.openwall.com Subject: Re: [SECURITY ADVISORY] IDNA 2003 makes curl use wrong host * Daniel Stenberg: > When curl is built with libidn to handle International Domain Names > (IDNA), it translates them to puny code for DNS resolving using the > IDNA 2003 standard, while IDNA 2008 is the modern and up-to-date > IDNA standard. I think everyone in the software space assumes that all DNS registries block registrations which would allocate names colliding under the IDNA 2003 and 2008 standards to different owners. There were even attempts at the registry level to automatically alias different encodings (something which is difficult because it interferes with the goal to make the whole thing application-centric). > For example, `straße.de` is translated into `strasse.de` using IDNA > 2003 but is translated into `xn--strae-oqa.de` using IDNA > 2008. Needless to say, those host names could very well resolve to > different addresses and be two completely independent servers. IDNA > 2008 is mandatory for .de domains. What does DENIC say about this matter? It looks like their implementation of IDNA is just very broken.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ