[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH 0/1] curl: Fix CVE-2016-3739.

From: ng0
Subject: Re: [PATCH 0/1] curl: Fix CVE-2016-3739.
Date: Sun, 12 Jun 2016 21:02:32 +0000

On 2016-06-12(10:51:14+0200), Ludovic Courtès wrote:
> Leo Famulari <address@hidden> skribis:
> > If your SSL / TLS provider is mbedTLS (formerly PolarSSL), there is a
> > bug in curl [CVE-2016-3739] that allows an attacker to bypass the full
> > certificate check by presenting any valid certificate.
> >
> > So, you might think are connecting to, when in fact
> > the attacker has a certificate for any other domain.
> >
> > We don't package mbedTLS, but I still think we should provide the fixed
> > source code.
> OTOH this will incur additional grafting for no reason, WDYT?
> Thanks,
> Ludo’.


mbedtls is on my list of packages to do, as the webserver hiawatha
depends on it.

Should I announce once it is packaged and the cve fix can be applied

♥Ⓐ ng0
For non-prism friendly talk find me on / loupsycedyglgamf.onion

Attachment: signature.asc
Description: Digital signature

reply via email to

[Prev in Thread] Current Thread [Next in Thread]