oss-security - Re: CVE request: epiphany not checking ssl certs

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1327423490.110981284748754244.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Fri, 17 Sep 2010 14:39:14 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Hanno Böck <hanno@...eck.de>
Subject: Re: CVE request: epiphany not checking ssl certs


----- "Tomas Hoger" <thoger@...hat.com> wrote:

> On Fri, 17 Sep 2010 14:19:03 +0200 Hanno Böck wrote:
> 
> > http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=564690
> > http://blog.fefe.de/?ts=b26ca29d
> > 
> > Did this get a CVE yet?
> 
> Any specific reason to only give CVE to epiphany if you want to start
> giving CVEs for this kind of flaw?  IIRC, not long ago, no
> WebKitGtk-based browser I tried verified server SSL certificates and all
> connected without any complaint or indication that SSL certificate was
> not verified.  None seemed to offer any configuration option to enable
> certificate checking.  I guess there may be / was some limitations on
> WebKitGtk side that can explain this.
> 
> I noticed midori now uses different address bar background color, which
> seem to be similar to the epiphany fix described in the Debian bug.
> 
> Oh, now I see you're probably asking for CVE for post-deb#564690
> behavior, not pre-deb#564690, right?
> 

I'm not following this. What exactly is getting a CVE id here?

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.