[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 20 Apr 2016 00:33:30 -0400 (EDT)
From: cve-assign@...re.org
To: matthias@...lons.info
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: opam - missing certificate validation
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
> https://github.com/ocaml/opam/commit/3d43295df3bb9e67e60801d319bf82c2c8a84d24
> https://github.com/ocaml/opam/commit/5507426030a60c50f7479ac758d116b573fdbd5e
> https://github.com/ocaml/opam/issues/55
> https://github.com/ocaml/opam/issues/2006
> https://github.com/ocaml/opam/issues/2006#issue-57763563
> This was added because of compatibility issues on many common
> installations, in which curl didn't have access to a reasonable list
> of root certificates (in particular for github). I am wondering if
> this is still an issue now ?
>
> We still double-check md5s of course.
> src/repository/opamDownload.ml
>
> let curl_args = [
>
> - CString "--insecure", None;
>
> let wget_args = [
>
> - CString "--no-check-certificate", None;
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=818081#15
>
> This issue does not warrant a DSA, but may be good to fix it as well
> in an upcoming jessie point release.
We feel that this should not have a CVE ID because the removed curl
and wget options had been intentional behavior. In other words, the
vendor was not particularly interested in ensuring that the client was
communicating with the correct web site. That required relying on
third parties (maintainers of curl and wget) to maintain certificate
data. Instead, the vendor was interested in whether the client was
downloading the correct file. Achieving that can be independent.
- --
CVE Assignment Team
M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
[ A PGP key is available for encrypted communications at
http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJXFwYcAAoJEHb/MwWLVhi2lS4P/3g0tuTBDJFhdPjGYs52WncH
4oyAXUPboTN/1ED1D9bcmARcBjE1lik2yMoM4JU0nuwiCj9aPwkXofpt8TCp3As8
haSrupzKzU0bpHeDVnTwXyc4a04CQ9WAaPDqDgPRViZN7AYKoyhF02zVxNN4jyXu
CCPp3YsJCHLUvx5UFCFf5XevQBikINm1HuJiizoePHqrl5l6g0efsOulIpC4cGLo
OobJanX3QNYNQe/bVfFS0R/tJysyDErSRLYzN3prhDDgoe/F1q1Unp/BKlEh0Cub
+y0tw420qnIAhebz2CD3jgO5rAv1RA8zXOETtNl/m93oG/lyJa9YDRTXxetuW3K6
ulOQUrlM0l05cmsLKAYuqtPzeEyv6umfGhH/cG4NjHiaUlgXqihNdHRMjcQl5Bx8
XZ6cAn9XHuMqYBDffuSRspsXIkCZYzwlS6CRqy4uyPN+HH33CB5NHfRAhZFiEDY6
vK3cRgkcjrU6w6yQ43O8ttNiN6YpFocGXfImf/8FM1jcwBjsnl8IKufdZCKS+NJj
8/2Atu+aCdbhEVV+i3iEeeL806c1fH92JKmZxWvkU4/6W8xVS2uITqmuVRhg++5n
tjTH4TrCpi1yjOsl3+PfSSqSsmoVrPe+hHRCXRZYmQ86b+eZXGr2oQt3Cic4xx21
FakLj9DAVjQBfk65+Jud
=/IEH
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
