Re: Re: CVE request: claws-mail vcalendar plugin stores user/password in cleartext

[Michael Samuel <mik () miknet net>]

On 12 March 2014 20:56, Marcus Meissner <meissner () suse de> wrote:

> Note comment by author(?):
> "However, while I agree that CURLOPT_SSL_VERIFYHOST should probably be
> enabled, I do not see any usefulness in enabling CURLOPT_SSL_VERIFYPEER. I
> do not really buy into the extortion racket that certificate authority
> companies run."

For people that take this (somewhat valid) stance WRT CAs, the answer is to
retrieve
the self-signed certificate and either add it to the system's ca-trust
store, or specify
CURLOPT_CAINFO with a file containing the self-signed certificate.

Note that CURLOPT_CAINFO doesn't do proper pinning - this won't work with a
CA-issued certificate unless the CA certificate was in the file too, as the
host
certificate would contain the CA:false basicConstraint.  That CA could
issue another
certificate for the host and it would be accepted.

Disabling SSL_VERIFYPEER is as obviously broken as an inetd service calling
gets().
An author's claim that this is fine runs counter to users' expectation that
enabling TLS
provides security.

Regards,
  Michael