Re: [PATCH 0/1] curl: Fix CVE-2016-3739.

[Ludovic Courtès]

Leo Famulari <address@hidden> skribis:

> If your SSL / TLS provider is mbedTLS (formerly PolarSSL), there is a
> bug in curl [CVE-2016-3739] that allows an attacker to bypass the full
> certificate check by presenting any valid certificate.
>
> So, you might think are connecting to https://example.com, when in fact
> the attacker has a certificate for any other domain.
>
> We don't package mbedTLS, but I still think we should provide the fixed
> source code.

OTOH this will incur additional grafting for no reason, WDYT?

Thanks,
Ludo’.