oss-sec mailing list archives
Re: Twisted Security Issue
From: cve-assign () mitre org
Date: Mon, 22 Sep 2014 02:12:28 -0400 (EDT)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
When specifying the trustRoot (CA store) for the HTTP client, Twisted did not respect the user's specification, and always used the default of the platform trust. This means that users attempting to use this feature to implement certificate pinning, or otherwise restrict the trust CAs would still have accepted any certificate signed by a CA. Twisted 14.0.1 has been issued to resolve this
Use CVE-2014-7143. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJUH71eAAoJEKllVAevmvmsRaAH/2qxppDYa1jQSSgD+wMzROaA WerCsjha9VIhcYATLNRl/YIItZn2v+oQBbNOfFgFUpETzIupk2ZC0CQitE7JarWG tGbd6gjllfj6Or5swjgYvOGvst6WIcgW58iWUseQ5dOO2OmAiSwdFzsbameR3uXQ SiTbn0VV0CLj4X45NPpONOx2PFdNDU4pxcz/GHaNGc1C++E1LCQgX2gX/DAuFqc0 pd/srMentAQxLmRkFvDsYlzDgxl/GAWHk9zzh4IXOwhLthWOP9V3NB50UGtZ9Owu PcJzpXN3qktXDD8xS/2t8xFm3mqIDDkJx1uyA58F81j7MGqv0IulRir+mcyhtqo= =hS6Z -----END PGP SIGNATURE-----
Current thread:
- Twisted Security Issue Alex Gaynor (Sep 17)
- Re: Twisted Security Issue cve-assign (Sep 21)