Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 23 Nov 2012 14:36:24 +0100
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Gajim fails to handle invalid certificates

On 11/14/2012 10:36 AM, Kurt Seifried wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 11/14/2012 02:19 AM, Florian Weimer wrote:
>> On 11/14/2012 08:19 AM, Kurt Seiifried wrote:
>>
>>> So do we consider this to be an OpenSSL issue of gajim? I'm sure
>>> gajim is not the only program that does something like this.
>>
>> As far as I understand things, it is not necessarily at all to set
>> a verification callback in OpenSSL.  If you load the root
>> certificate store and examine SSL_get_verify_result, that should be
>> sufficient.  You can even look at the peer certificate and continue
>> anyway if the user has overridden the certificate validity.  So
>> far, I haven't found a good reason to use a verify callback at all.
>> You need it to implement a custom PKIX validation policy, but that
>> should be pretty rare.  (I still have to check older OpenSSL
>> versions, though, perhaps there, the behavior was different.)
>>
>> Anyway, if application developers set a verification callback, it
>> is their responsibility to implement it correctly.  Therefore, I
>> don't think this is an OpenSSL issue.
>
> Makes sense, just wanted to confirm this problem resides within Gajim.
> Please use CVE-2012-5524 for this issue.

Regarding the OpenSSL behavior, there appears to be a related bug report:

<http://rt.openssl.org/Ticket/Display.html?id=2768&user=guest&pass=guest>

-- 
Florian Weimer / Red Hat Product Security Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.