Date: Sat, 17 Apr 2010 16:37:59 -0500 From: Jamie Strandboge <jamie@...onical.com> To: Wouter Coekaerts <coekie@...si.org> Cc: oss-security <oss-security@...ts.openwall.com>, Steve Langasek <steve.langasek@...onical.com> Subject: Re: Re: CVE request: irssi 0.8.15 FYI, I backported the following svn commits to 0.8.14 for the SSL issue: r5104: Check if an SSL certificate matches the hostname of the server we are connecting to r5107: Use one SSL_CTX per connection, use default trusted CAs if nothing specified. This allows useful use of -ssl_verify without -ssl_cafile/-ssl_capath, using OpenSSL's default trusted CAs. r5108: Call OpenSSL_add_all_algorithms(), may be needed to verify SHA256 certs with certain versions of OpenSSL. r5116: network-openssl: Show why a certificate failed validation. r5136 Do not use SSLv2 protocol. From Bazerka. However, after rolling it out Steve Langasek discovered a bug when connecting to an SSL irc proxy server. His patch (attached) adjusts it so when we have a proxy setting, expect the CN to match the proxy hostname, not the server hostname  https://bugs.launchpad.net/ubuntu/+source/irssi/+bug/565182 -- Jamie Strandboge | http://www.canonical.com View attachment "irssi-565182.diff" of type "text/x-patch" (1185 bytes) Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.