Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 30 Jan 2015 07:15:42 -0700
From: Kurt Seifried <>
Subject: Re: CVE request: xchat/hexchat don't properly verify
 SSL certificates

On 30/01/15 02:56 AM, Michael Samuel wrote:
> On 30 January 2015 at 06:24, Sam Dodrill <> wrote:
>> A lot of the time IRC networks will not pay for a verified SSL cert due to
>> the fact that the kind of SSL cert they would need (a wildcard one) is
>> financially prohibitive. I don't think this is a security bug with hexchat
>> more a symptom of the fact that SSL combines encryption and identity
>> verification where sometimes people only want the former.
> The correct response to this is for them to publish their self-signed
> certificate (or even a CA certificate) and have it pasted into the
> client, along with the configuration.

Sorry what? A DV (Domain Validated) wildcard cert is now 80-90$ a year
from many providers (google "cheap ssl"). SSL certs are no longer
expensive and have not been for many years.

> The client could then perform a byte-wise compare of the public key.
> I assume well-known networks could have their certificates hard-coded
> into the client.

No. Just no. You put root certs on the client side, not the actual
server certs. Google "crypto agility" and so on.

Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.