Re: CVE request: fetchmail <= 6.3.10 SSL certificate NUL prefix verification bypass

[Tomas Hoger <thoger () redhat com>]

Hi Matthias!

On Wed, 05 Aug 2009 18:55:39 +0200 "Matthias Andree"
<matthias.andree () gmx de> wrote:

> FWIW, I haven't yet tested if this works for NUL in subjectAltNames,
> as I currently don't know how to generate such a certificate (can be  
> self-signed) without writing major amounts of code.
>
> If someone has a certificate that has embedded NULs in
> subjectAltNames that I can use for testing, please send it along
> together with its key so that I can check the fix also works in that
> code path.

I managed to build these, that may be helpful during the testing:

  http://people.redhat.com/thoger/certs-with-nuls/

Let me know if anything needed is missing there.

HTH

-- 
Tomas Hoger / Red Hat Security Response Team