oss-security - Re: CVE Request: libesmtp does not check NULL bytes in commonName

server OS

Message-ID: <20100316133349.GA2713@redhat.com>
Date: Tue, 16 Mar 2010 13:33:49 +0000
From: Joe Orton <jorton@...hat.com>
To: Brian Stafford <brian@...fford.uklinux.net>
Cc: oss-security@...ts.openwall.com, libesmtp@...fford.uklinux.net,
        security@...ntu.com, Pawel Salek <pawsa@...ochem.kth.se>,
        jskarvad@...hat.com
Subject: Re: CVE Request: libesmtp does not check NULL bytes
 in commonName

On Tue, Mar 16, 2010 at 11:46:11AM +0000, Brian Stafford wrote:
> Ludwig Nussel wrote:
> >Is there a way to comment on the draft? Maybe the author of the
> >draft didn't think about the cases you'd like to handle.
>
> Normally IETF working groups create a mailing list for discussion of
> drafts when chartered and any interested party may subscribe.
> However, as far as I can tell, this I-D is an individual submission;
> I can't find a mailing list address so probably best to mail the
> authors directly.

Sorry, I should have forwarded the announcement in full:

http://www.ietf.org/mail-archive/web/tls/current/msg05874.html

There is a mailing list set up here to discuss the draft:

https://www.ietf.org/mailman/listinfo/certid

Regards, Joe