Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 16 Apr 2014 22:10:35 +0200
From: Raphael Geissert <>
To: Open Source Security <>
Subject: CVE request: openssl: missing critical flag for extended key usage not always detected in time-stamp verification


Quoting from [0]:
> "check_purpose_timestamp_sign()" in source file v3_purp.c [...] fails to
> detect a missing critical flag if the extensions of the TSA certificate
> are arranged in a specific order.

Could a CVE id be assigned for this?

The referenced commit fixes it "and to two other cases in the same file."


Digging through history, the bug on TSA was introduced in 
(Strangely tagged for 0.9.8l and 0.9.8k but none of the other versions of 
the 0.9.8 branch)

And the two others in:
(going all the way back to 0.9.7)

Haven't checked if the meaning of the X509_get_ext_by_NID parameter changed 
at some point.

Raphael Geissert - Debian Developer -

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.