Re: CVE Request: Go crypto/tls vulnerability

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> https://groups.google.com/forum/#!msg/golang-nuts/eeOHNw_shwU/OHALUmroA5kJ
>
> Go 1.3.2 release announcement:
>
> The crpyto/tls fix addresses a security bug that affects programs that use
> crypto/tls to implement a TLS server from Go 1.1 onwards. If the server enables
> TLS client authentication using certificates (this is rare) and explicitly sets
> SessionTicketsDisabled to true in the tls.Config, then a malicious client can
> falsely assert ownership of any client certificate it wishes.

Use CVE-2014-7189.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJUJap3AAoJEKllVAevmvmsgrMH/j/1XloOl9HhN2u3Wr2s/3Lk
xhgj82xPuHcb2Pp2hqhbYDwIMQxcA9V1t7DEDTkZi+M5lH4tVOEspWcHDExCveK8
IAeiALqGyG1Jt5akec27aHA1l8SRbXzq4lqEo/+M9bRCgTYh0ctZZn4+l3M+6pCx
m4WDJSndOMuIlSa58aW7nOxyaFAnYo3kS2nUvdKxuHnctmQjOrDaRnuK89p7FXa3
tFDPMe0ZhsZoNB+nCDvpHW/2WSp67pASSufQQ0lKx7YIEpS+Jx4YdnwmYeXLOj58
JkYbS0dg4QSF0yW2AKNtOnFuQdhXGVl6vmTKpWhfUczDgJfgE7yEKBCV1OAfLgc=
=00Zi
-----END PGP SIGNATURE-----