Possible CVE for TLS protocol issue

[Kurt Seifried <kseifried () redhat com>]

This was pointed out to me by mjc@:

https://kcitls.org/

TL;DR: if you can trick someone to install a client certificate you can
then spoof any future web site. Certainly not what we want from the people
issuing client certificates. It sounds like this is a protocol level
vulnerability affecting closed and Open Source vendors potentially, and it
is public so posting it here.

--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert () redhat com