[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <50A36229.7020908@redhat.com>
Date: Wed, 14 Nov 2012 10:19:37 +0100
From: Florian Weimer <fweimer@...hat.com>
To: kseifried@...hat.com
CC: oss-security@...ts.openwall.com
Subject: Re: Gajim fails to handle invalid certificates
On 11/14/2012 08:19 AM, Kurt Seiifried wrote:
> So do we consider this to be an OpenSSL issue of gajim? I'm sure gajim
> is not the only program that does something like this.
As far as I understand things, it is not necessarily at all to set a
verification callback in OpenSSL. If you load the root certificate
store and examine SSL_get_verify_result, that should be sufficient. You
can even look at the peer certificate and continue anyway if the user
has overridden the certificate validity. So far, I haven't found a good
reason to use a verify callback at all. You need it to implement a
custom PKIX validation policy, but that should be pretty rare. (I still
have to check older OpenSSL versions, though, perhaps there, the
behavior was different.)
Anyway, if application developers set a verification callback, it is
their responsibility to implement it correctly. Therefore, I don't
think this is an OpenSSL issue.
--
Florian Weimer / Red Hat Product Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
