oss-security - CVE Request -- kdebase4 (konqueror) -- Incomplete SSL Certificate support in KDE4

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Tue, 12 May 2009 16:00:46 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: Steven Christey <coley@...us.mitre.org>
Cc: oss-security@...ts.openwall.com
Subject: CVE Request -- kdebase4 (konqueror) -- Incomplete SSL Certificate
 support in KDE4

Hello Steve,

  not sure if original Debian bug [1] reporter meant this insufficiency,
but [2] might be interesting for your attention. While this is not
direct security vulnerability, is is preventing users from using
the functionality provided by digital certificates.

References:
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526979
[2] https://bugs.kde.org/show_bug.cgi?id=185288
[3] https://bugzilla.redhat.com/show_bug.cgi?id=500373

This issue is present only in Konqueror web browser, as shipped
with the K Desktop Environment 4 (kdebase-4.*). Konqueror in
kdebase3 works fine.

Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.