[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201302051049.56639.mweckbecker@suse.de>
Date: Tue, 5 Feb 2013 10:49:56 +0100
From: Matthias Weckbecker <mweckbecker@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations
On Tuesday 05 February 2013 10:40:57 Matthias Weckbecker wrote:
> b8391806cd79095fe566f2401d8c7ad85a64b198 seems to be the commit for GnuTLS
> that fixes the issue.
>
Links:
https://gitorious.org/gnutls/gnutls/commit/328ee22c1b3951e060c7124c7cb1cee592c59bc0
https://gitorious.org/gnutls/gnutls/commit/b8391806cd79095fe566f2401d8c7ad85a64b198
Sorry for the spam,
Matthias
> On Tuesday 05 February 2013 10:34:23 Matthias Weckbecker wrote:
> > Hi,
> >
> > has there already been a CVE assigned for the recent "lucky 13" timing
> > flaw that affects various SSL / TLS implementations (including GnuTLS)?
> >
> > http://www.isg.rhul.ac.uk/tls/
> > http://www.gnutls.org/security.html#GNUTLS-SA-2013-1
> >
> > I think this could qualify for CVE for each open source implementation
> > that's prone.
> >
> > Thanks,
> > Matthias
--
Matthias Weckbecker, Senior Security Engineer, SUSE Security Team
SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg, Germany
Tel: +49-911-74053-0; http://suse.com/
SUSE LINUX Products GmbH, GF: Jeff Hawn, HRB 16746 (AG Nuernberg)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
