[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANO=Ty3Hd-hRYmfSsRoLoOwQC-Dvx+ENLDwM1bL3R6xKmhqukA@mail.gmail.com>
Date: Sun, 21 Aug 2016 20:45:01 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security <oss-security@...ts.openwall.com>
Cc: "ouspg@...oulu.fi" <ouspg@...oulu.fi>
Subject: Re: TLS testing results - OS distro vulnerabilities
If you find apps/distros/etc that are NOT checking certificate validity
properly please either ask for CVEs here or contact DWF for CVEs (for open
source stuff). Thanks.
On Sat, Aug 20, 2016 at 10:50 AM, Mauri Miettinen <
Mauri.Miettinen@...dent.oulu.fi> wrote:
> To whom it may concern,
>
> We developed a tool to check if languages and libraries verify TLS
> certificates properly.
> While testing this tool we did a shootout against supported versions of the
> some major Linux distributions.
>
> Results are available from:
>
> https://github.com/ouspg/trytls/blob/shootout-0.3/shootout/README.md
>
> It seems it may be unsafe to do TLS in some of the common distros.
> E.g. the native Python version in the distros varies, and not all fixes
> have
> been backported. In these cases Python still doesn't always have
> certificate
> checking enabled by default.
>
> We have contacted Python developers about the results.
>
> https://mail.python.org/pipermail/python-dev/2016-August/145815.html
>
> They gave us a couple of good pointers on how configuration could be
> used to mitigate the issues in some of the distributions. We are afraid
> this is still a hazard where neither software developers or users realize
> that code that works well for the developer may not be safe for the users.
>
> Would you have any other resources, advice or pointers we should
> document when communicating about this in the TryTLS project?
>
> Mauri Miettinen
>
> PS. Results have indications of weak crypto issues as well.
--
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
