oss-security - CVE Request: httplib2 ssl cert incorrect error handling

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 01 May 2013 16:15:19 -0700
From: Marc Deslauriers <marc.deslauriers@...onical.com>
To: oss-security@...ts.openwall.com
Subject: CVE Request: httplib2 ssl cert incorrect error handling

Hello,

httplib2 only validates SSL certificates on the first request to a
connection, and doesn't report validation failures on subsequent requests.

Bugs:

http://code.google.com/p/httplib2/issues/detail?id=282
https://bugs.launchpad.net/httplib2/+bug/1175272

Could a CVE please be assigned to this issue?

Thanks,

Marc.

-- 
Marc Deslauriers
Ubuntu Security Engineer     | http://www.ubuntu.com/
Canonical Ltd.               | http://www.canonical.com/

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.