|
oss-sec
mailing list archives
Re: CVE-2009-3555 for TLS renegotiation MITM attacks
From: Florian Weimer <fw () deneb enyo de>
Date: Thu, 05 Nov 2009 18:24:09 +0100
* Mark J. Cox:
http://extendedsubset.com/?p=8
http://www.ietf.org/mail-archive/web/tls/current/msg03948.html and so
on
https://bugzilla.redhat.com/show_bug.cgi?id=533125
Marsh Ray of PhoneFactor has discovered a flaw in the TLS/SSL protocol
related to the handling of the session renegotiations.
Shouldn't this be credited to Martin Rex from SAP? He's the first one
who publicly comitted to this vulnerability. (And I'm slightly
surprised by the rapid me-too-ing that's going on here.)
Anyway, is the CVE just for HTTP over TLS, or more?
 By Date 
By Thread
Current thread:
| 
