Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 2 Nov 2016 13:52:41 +0100
From: Hanno Böck <>
Subject: Re: [SECURITY ADVISORY] IDNA 2003 makes curl use
 wrong host

On Wed, 2 Nov 2016 12:53:04 +0100
Robert Scheck <> wrote:

> On the other hand, I am wondering if this should be really classified
> as a security related issue.

Ambiguitiy in character encodings can often be a source of security

Just think of the following:
* A Certificate Authority is using different pieces of software that
  mix different IDNA encodings.
* I request a certificate for, but the verification mail
  goes to
* I am the owner of and now have a valid certificate

IMHO the whole idea of suddenly changing how international domain names
are encoded is a very problematic security violation.

Hanno Böck

GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.