[prev in list] [next in list] [prev in thread] [next in thread]
List: oss-security
Subject: Re: [oss-security] Gajim fails to handle invalid certificates
From: Florian Weimer <fweimer () redhat ! com>
Date: 2012-11-23 13:36:24
Message-ID: 50AF7BD8.1010605 () redhat ! com
[Download RAW message or body]
On 11/14/2012 10:36 AM, Kurt Seifried wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 11/14/2012 02:19 AM, Florian Weimer wrote:
>> On 11/14/2012 08:19 AM, Kurt Seiifried wrote:
>>
>>> So do we consider this to be an OpenSSL issue of gajim? I'm sure
>>> gajim is not the only program that does something like this.
>>
>> As far as I understand things, it is not necessarily at all to set
>> a verification callback in OpenSSL. If you load the root
>> certificate store and examine SSL_get_verify_result, that should be
>> sufficient. You can even look at the peer certificate and continue
>> anyway if the user has overridden the certificate validity. So
>> far, I haven't found a good reason to use a verify callback at all.
>> You need it to implement a custom PKIX validation policy, but that
>> should be pretty rare. (I still have to check older OpenSSL
>> versions, though, perhaps there, the behavior was different.)
>>
>> Anyway, if application developers set a verification callback, it
>> is their responsibility to implement it correctly. Therefore, I
>> don't think this is an OpenSSL issue.
>
> Makes sense, just wanted to confirm this problem resides within Gajim.
> Please use CVE-2012-5524 for this issue.
Regarding the OpenSSL behavior, there appears to be a related bug report:
<http://rt.openssl.org/Ticket/Display.html?id=2768&user=guest&pass=guest>
--
Florian Weimer / Red Hat Product Security Team
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic