Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 7 Nov 2014 02:58:09 +0100
From: "Jason A. Donenfeld" <>
To: oss-security <>
Subject: Re: CVE Request: Qt Creator fails to verify SSH host key

On Fri, Nov 7, 2014 at 12:24 AM, Michael Samuel <> wrote:
> This is a serious bug (it certainly circumvents the security of
> OpenSSH),

My opinion too (obviously).

> but I think
> the proposed fix doesn't fit.

The patch on there most certainly won't be accepted -- it's just something
I hacked together in 5 minutes to use on my own project, and I figured the
Qt devs might get some inspiration to do it themselves, after seeing the
guts aren't really that hard.

> What might be a better solution is to store the public key for all
> devices, and accept
> if it matches any device you've talked to before.  On discovering a
> new device, it shows
> the fingerprint and prompts for a name/description.
> Then you can revoke devices in some other part of the UI when you need
> to clean up.

That actually seems like a decent compromise.  Though, it does mean if you
compromise one device that's ever been trusted, you compromise all others
by extension. But maybe that's okay for the use here.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.