Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777

[John Haxby <john.haxby () oracle com>]

On 11/03/15 15:48, Kurt Seifried wrote:
> On 03/10/2015 08:05 PM, Michael Samuel wrote:
> > Hi Kurt,
> >
> > Your corporate pissing match with Oracle is not helpful.

Indeed, please cut it out.  You're dealing with an individual, me,
here.   I'm just someone who is trying to improve things in small but
useful ways.   Someone who, incidentally, is personally hurt all of this.

> I think there's probably some cultural disconnect here that is
> causing issues, a big part of Red Hat is "upstream first" and doing
> things the open source way.

We're actually no different, whatever you might think.  (Obviously this
does not apply to the large suite of closed or semi-closed applications
that oracle produces; I'm only talking about the Linux group here.)

[snip]

> However here's the cool thing. If Oracle thinks they have a good 
> solution they can participate with upstreams, or simply try it.

I think there's a misunderstanding here.  I was asking for cooperation
to come up with a solution, participating with other people who, like,
I assumed, Red Hat, have an interest in solving this specific problem
without breaking existing (admitedly flawed) applications.  I know it's
 not straightforward, if it was I'd've just produced a patch.  I'm still
happy to work with anyone to sort this out.

[snip]

> I am actually working on something that will hopefully provide a
> better solution (for values of speed and ease of fixing flaws) than
> a traditional audit/code fix, (I'd rather address entire classes
> of security flaw rather than one instance of the flaw at a time).
> But like all things security infinite workload delays specific
> projects.

If this fixes the specific problem as a side effect that would be
great.  Details are lacking though, and there's no obvious link here
to making adapting PEP-466 for backwards compatibility (and I have
absolutely no arguments with the rejected solutions for Python).



This is my last message on the list on the subject.

jch