Date: Thu, 05 Nov 2009 18:24:09 +0100 From: Florian Weimer <fw@...eb.enyo.de> To: oss-security@...ts.openwall.com Subject: Re: CVE-2009-3555 for TLS renegotiation MITM attacks * Mark J. Cox: > http://extendedsubset.com/?p=8 > http://www.ietf.org/mail-archive/web/tls/current/msg03948.html and so > on > https://bugzilla.redhat.com/show_bug.cgi?id=533125 > > Marsh Ray of PhoneFactor has discovered a flaw in the TLS/SSL protocol > related to the handling of the session renegotiations. Shouldn't this be credited to Martin Rex from SAP? He's the first one who publicly comitted to this vulnerability. (And I'm slightly surprised by the rapid me-too-ing that's going on here.) Anyway, is the CVE just for HTTP over TLS, or more?
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.