oss-sec mailing list archives
Re: CVE request: fetchmail <= 6.3.10 SSL certificate NUL prefix verification bypass
From: Tomas Hoger <thoger () redhat com>
Date: Wed, 5 Aug 2009 18:30:08 +0200
Hi Matthias! Thanks for the heads-up! On Wed, 05 Aug 2009 17:14:36 +0200 "Matthias Andree" <matthias.andree () gmx de> wrote:
Is there a global CVE ID to collect this vulnerability that is supposed to be reused by applications?
That's actually a pretty good question. This problem was first presented for Firefox/NSS and got assigned CVE-2009-2408. Similar problem also affects GnuTLS and some changes are being discussed on the -devel mailing list, with some changes and tests already in git. This should deserve a separate CVE. And than there is OpenSSL, which, as I've been told, expects applications to do name checking. So it's probably safe to assume that many / majority of client applications using OpenSSL are likely to be affected by some variant of this problem (either via CommonNames or subjectAltNames). I'm not sure if single CVE should be used here for all, or dozens of CVEs, one for each. It's likely going to be mess either way. I'm adding CC on Steven for advice. Steven, at least one CVE has already been allocated privately for similar case. -- Tomas Hoger / Red Hat Security Response Team
Current thread:
- CVE request: fetchmail <= 6.3.10 SSL certificate NUL prefix verification bypass Matthias Andree (Aug 05)
- Re: CVE request: fetchmail <= 6.3.10 SSL certificate NUL prefix verification bypass Tomas Hoger (Aug 05)
- Re: CVE request: fetchmail <= 6.3.10 SSL certificate NUL prefix verification bypass Matthias Andree (Aug 05)
- Re: CVE request: fetchmail <= 6.3.10 SSL certificate NUL prefix verification bypass Steven M. Christey (Aug 05)
- Re: CVE request: fetchmail <= 6.3.10 SSL certificate NUL prefix verification bypass Tomas Hoger (Aug 05)
- Re: CVE request: fetchmail <= 6.3.10 SSL certificate NUL prefix verification bypass Matthias Andree (Aug 05)
- Re: "umbrella" CVE names (was: CVE request: fetchmail <= 6.3.10 SSL certificate NUL prefix verification bypass) Matthias Andree (Aug 21)
- Re: CVE request: fetchmail <= 6.3.10 SSL certificate NUL prefix verification bypass Tomas Hoger (Aug 05)
- Re: CVE request: fetchmail <= 6.3.10 SSL certificate NUL prefix verification bypass Matthias Andree (Aug 05)
- Re: CVE request: fetchmail <= 6.3.10 SSL certificate NUL prefix verification bypass Henri Salo (Aug 05)
- Re: CVE request: fetchmail <= 6.3.10 SSL certificate NUL prefix verification bypass Tomas Hoger (Aug 05)