Date: Wed, 16 Apr 2014 22:10:35 +0200 From: Raphael Geissert <geissert@...ian.org> To: Open Source Security <oss-security@...ts.openwall.com> Subject: CVE request: openssl: missing critical flag for extended key usage not always detected in time-stamp verification Hi, Quoting from : > "check_purpose_timestamp_sign()" in source file v3_purp.c [...] fails to > detect a missing critical flag if the extensions of the TSA certificate > are arranged in a specific order. Could a CVE id be assigned for this? The referenced commit fixes it "and to two other cases in the same file." References: http://rt.openssl.org/Ticket/Display.html?id=3309&user=guest&pass=guest http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=300b9f0b704048f60776881f1d378c74d9c32fbd Digging through history, the bug on TSA was introduced in http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=c7235be6e36c4bef84594aa3b2f0561db84b63d8 (Strangely tagged for 0.9.8l and 0.9.8k but none of the other versions of the 0.9.8 branch) And the two others in: http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=d9bfe4f97cd4244beb0598cc348d68b04dac7068 (going all the way back to 0.9.7) Haven't checked if the meaning of the X509_get_ext_by_NID parameter changed at some point. Cheers, -- Raphael Geissert - Debian Developer www.debian.org - get.debian.net
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.