Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 2 May 2012 16:17:52 -0600
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request: libsoup 2.32.2 sets ssl trusted flag
 despite no verification

* [2012-05-02 10:20:24 +0200] Ludwig Nussel wrote:

>Vincent Danen wrote:
>> * [2012-04-24 12:04:24 +0200] Ludwig Nussel wrote:
>>
>>> libsoup 2.32.2 does not verify certificates at all if an application does
>>> not explicitly specify a file with trusted root CA's. Since that libsoup
>>> version relies on the verification failure to clear the trust flag it
>>> always considers ssl connections as trusted in that case.
>>>
>>> Reference:
>>> https://bugzilla.novell.com/show_bug.cgi?id=758431
>>
>> Are you sure it's just this specific version of libsoup?  Looking at the
>> code of earlier versions (such as 2.2.98), the patch noted in your bug
>> would apply (unless there is some other context around it that would
>> make this a non-issue?).  Did you look at other versions at all?
>
>No, we actually didn't.

At least 2.34 is vulnerable as well.  Older versions, at least 2.28,
don't have the vulnerable feature (so it broke somewhere between 2.28
and 2.32.2, likely when the feature was added).

-- 
Vincent Danen / Red Hat Security Response Team 

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.