Date: Fri, 04 May 2012 10:03:20 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: Steve Beattie <steve@...w.org> Subject: Re: CVE Request: evolution-data-server lacks SSL checking in its libsoup users -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 05/04/2012 02:30 AM, Steve Beattie wrote: > On Fri, May 04, 2012 at 10:03:11AM +0200, Marcus Meissner wrote: >> This was already reported: >> https://bugzilla.gnome.org/show_bug.cgi?id=671537 >> https://launchpad.net/bugs/933659 (private still) >> >> so it might have a CVE already. > > I've made the launchpad bug public now. There was no CVE assigned > in that report. > > Thanks. > Shouldn't these all be covered by the libsoup CVE: > libsoup 2.32.2 does not verify certificates at all if an > application does not explicitly specify a file with trusted root > CA's. Since that libsoup version relies on the verification > failure to clear the trust flag it always considers ssl connections > as trusted in that case. > > Reference: https://bugzilla.novell.com/show_bug.cgi?id=758431 > > cu Ludwig > Please use CVE-2012-2132 for this issue. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJPo/3IAAoJEBYNRVNeJnmTtPkQAKI4X13+7i3fStpzFpHamaUi 5/xgP6q+2ln/XVk11v4M6hN0VTr2gITPFk51x+MVnm+i9uBd8s5EtovrueA+eE8t bISTs6WSDDFrpOlR3nW1DN65bW9WT75dp1c4ehWZJXDtlOIeYAjKh+Avc0lxLLVM KeIaTv5nFHGaTth6ajreuW3esDYXAZ/mTlEfdyiUq2+6JtqE8TVl4sXRN0GOl7Ra wlBE8M28C3p8aqyeY5Esxq3chLNFF7WFaMkOkgNv5okpFrJ+QQ/8lT1nOf4pPgm8 ndDk69ICcNkfFerBxNY58Qb8BLD022qJOAaYsbAfty1//gLXtUjqf5Zq/c2o3DJ4 EaClDiLPAjwbc6T5JlDyatTdwLNlFDdziJTk3f0TU9Qffx7adbeCyPIA42GCnQp5 pS+xsAIayCW3S7cAT/quy4F7dOppSWJ9qT4wJjCvIvQejnOS4qmQNL7GLac4REgU wMYYW6DKGWb0zOW0WTP58IC+Ros3nK+YiHyyg8tpG9SvtGC7L8CE532Y1eXwZT9/ WccuEL3gQ9zOl3Y9EmTkj/770+msIRyjRQmuKpGwk/oUuKANlIfy4LwdSgD/PiGG 3jlIZjdNOic6OM0N3TKbvDuKp+tBy41lYig1e4AGSpPeX5oFF380MERWw+GZFx2+ dyiNsiZOsrcJTOYCKAMd =WbnO -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.