[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20150318085901.46C696C0029@smtpvmsrv1.mitre.org>
Date: Wed, 18 Mar 2015 04:59:01 -0400 (EDT)
From: cve-assign@...re.org
To: mcatanzaro@...lia.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, clopez@...lia.com
Subject: Re: CVE Request: WebKitGTK+ late TLS certificate verification
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> performed TLS certificate verification too late, after sending an HTTP
> request rather than before
> http://trac.webkit.org/changeset/181074/trunk/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
> cancel the load earlier in case of TLS failure, preventing any private
> data from being sent to the server before the TLS errors are checked.
Use CVE-2015-2330.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJVCT3iAAoJEKllVAevmvmsxKQH/jultcMvdU+k5BFXZAJFdlkZ
bA4OxvExB6WOLxVND04EIpxEqWPDn3xY7d1lCL7YbWvLFcsGU69WMOcYA9Ch3pIt
nfQSESTQNIt6GwfKwBpT97GC4dFOzM2yxT2l6i5rCQh0Nhbht29oCoNo0NmUyoFy
Gpcwy4bMug205DUQF5+W71oseZrUrGJNmC4iDVoQpj++hfWKNuN2a/dDrd4EaiwO
a4uBaoSNfVNa/F5zc7BhIfSo/t0BTYKS5nwya/ylQkB/AU4fDoIYfc9LkeZzox/i
9D8i3llDByGKcbJA98cvdzfq/7YkL/wQC3WEnbIcFmrNVt+LethWPvdoWw+9v2g=
=FaTN
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
