Re: CVE Request: libsoup 2.32.2 sets ssl trusted flag despite no verification

[Ludwig Nussel <ludwig.nussel () suse de>]

Vincent Danen wrote:
> * [2012-04-24 12:04:24 +0200] Ludwig Nussel wrote:
>
> > libsoup 2.32.2 does not verify certificates at all if an application does
> > not explicitly specify a file with trusted root CA's. Since that libsoup
> > version relies on the verification failure to clear the trust flag it
> > always considers ssl connections as trusted in that case.
> >
> > Reference:
> > https://bugzilla.novell.com/show_bug.cgi?id=758431
>
> Are you sure it's just this specific version of libsoup?  Looking at the
> code of earlier versions (such as 2.2.98), the patch noted in your bug
> would apply (unless there is some other context around it that would
> make this a non-issue?).  Did you look at other versions at all?

No, we actually didn't.

cu
Ludwig

-- 
 (o_   Ludwig Nussel
 //\
 V_/_  http://www.suse.de/
SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)