[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 26 Sep 2014 14:05:55 -0400 (EDT)
From: cve-assign@...re.org
To: marc.deslauriers@...onical.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE Request: Go crypto/tls vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> https://groups.google.com/forum/#!msg/golang-nuts/eeOHNw_shwU/OHALUmroA5kJ
>
> Go 1.3.2 release announcement:
>
> The crpyto/tls fix addresses a security bug that affects programs that use
> crypto/tls to implement a TLS server from Go 1.1 onwards. If the server enables
> TLS client authentication using certificates (this is rare) and explicitly sets
> SessionTicketsDisabled to true in the tls.Config, then a malicious client can
> falsely assert ownership of any client certificate it wishes.
Use CVE-2014-7189.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJUJap3AAoJEKllVAevmvmsgrMH/j/1XloOl9HhN2u3Wr2s/3Lk
xhgj82xPuHcb2Pp2hqhbYDwIMQxcA9V1t7DEDTkZi+M5lH4tVOEspWcHDExCveK8
IAeiALqGyG1Jt5akec27aHA1l8SRbXzq4lqEo/+M9bRCgTYh0ctZZn4+l3M+6pCx
m4WDJSndOMuIlSa58aW7nOxyaFAnYo3kS2nUvdKxuHnctmQjOrDaRnuK89p7FXa3
tFDPMe0ZhsZoNB+nCDvpHW/2WSp67pASSufQQ0lKx7YIEpS+Jx4YdnwmYeXLOj58
JkYbS0dg4QSF0yW2AKNtOnFuQdhXGVl6vmTKpWhfUczDgJfgE7yEKBCV1OAfLgc=
=00Zi
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
