Re: [Duplicity-talk] CVE-2014-3495 duplicity: improper verification of SSL certificates

[Kenneth Loafman]

Removed the privacy setting.  I thought it was already.

No, this has not been fixed yet.  It's on the list.

...Ken

On Thu, Jun 19, 2014 at 10:21 AM, Henri Salo <address@hidden> wrote:

Eric Christensen of Red Hat Product Security reported [1] that Duplicity did not
handle wildcard certificates properly.  If Duplicity were to connect to a remote
host that used a wildcard certificate, and the hostname does not match the
wildcard, it would still consider the connection valid.

1: https://bugs.launchpad.net/duplicity/+bug/1314234

Why is that upstream bug report still embargoed? Is there a fix for this
security issue already? If yes - what version or source control revision?

Debian: https://bugs.debian.org/751902
RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=1109999

---
Henri Salo