Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 17 Apr 2010 16:37:59 -0500
From: Jamie Strandboge <>
To: Wouter Coekaerts <>
Cc: oss-security <>, Steve Langasek <>
Subject: Re: Re: CVE request: irssi 0.8.15


I backported the following svn commits to 0.8.14 for the SSL issue:
  Check if an SSL certificate matches the hostname of the server we are
  connecting to
  Use one SSL_CTX per connection, use default trusted CAs if nothing
  specified. This allows useful use of -ssl_verify without
  -ssl_cafile/-ssl_capath, using OpenSSL's default trusted CAs.
  Call OpenSSL_add_all_algorithms(), may be needed to verify SHA256
  certs with certain versions of OpenSSL.
  network-openssl: Show why a certificate failed validation.
  Do not use SSLv2 protocol. From Bazerka.

However, after rolling it out Steve Langasek discovered a bug when
connecting to an SSL irc proxy server[1]. His patch (attached) adjusts
it so when we have a proxy setting, expect the CN to match the proxy
hostname, not the server hostname


Jamie Strandboge             |

View attachment "irssi-565182.diff" of type "text/x-patch" (1185 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.