oss-sec mailing list archives
Re: Gajim fails to handle invalid certificates
From: Florian Weimer <fweimer () redhat com>
Date: Fri, 23 Nov 2012 14:36:24 +0100
On 11/14/2012 10:36 AM, Kurt Seifried wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 11/14/2012 02:19 AM, Florian Weimer wrote:On 11/14/2012 08:19 AM, Kurt Seiifried wrote:So do we consider this to be an OpenSSL issue of gajim? I'm sure gajim is not the only program that does something like this.As far as I understand things, it is not necessarily at all to set a verification callback in OpenSSL. If you load the root certificate store and examine SSL_get_verify_result, that should be sufficient. You can even look at the peer certificate and continue anyway if the user has overridden the certificate validity. So far, I haven't found a good reason to use a verify callback at all. You need it to implement a custom PKIX validation policy, but that should be pretty rare. (I still have to check older OpenSSL versions, though, perhaps there, the behavior was different.) Anyway, if application developers set a verification callback, it is their responsibility to implement it correctly. Therefore, I don't think this is an OpenSSL issue.Makes sense, just wanted to confirm this problem resides within Gajim. Please use CVE-2012-5524 for this issue.
Regarding the OpenSSL behavior, there appears to be a related bug report: <http://rt.openssl.org/Ticket/Display.html?id=2768&user=guest&pass=guest> -- Florian Weimer / Red Hat Product Security Team
Current thread:
- Gajim fails to handle invalid certificates y33t (Nov 11)
- Re: Gajim fails to handle invalid certificates Kurt Seiifried (Nov 13)
- Re: Gajim fails to handle invalid certificates Florian Weimer (Nov 14)
- Re: Gajim fails to handle invalid certificates Kurt Seifried (Nov 14)
- Re: Gajim fails to handle invalid certificates Florian Weimer (Nov 23)
- Re: Gajim fails to handle invalid certificates Florian Weimer (Nov 14)
- Re: Gajim fails to handle invalid certificates Kurt Seiifried (Nov 13)