Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: Gajim fails to handle invalid certificates
From: Florian Weimer <fweimer () redhat com>
Date: Fri, 23 Nov 2012 14:36:24 +0100

On 11/14/2012 10:36 AM, Kurt Seifried wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/14/2012 02:19 AM, Florian Weimer wrote:
On 11/14/2012 08:19 AM, Kurt Seiifried wrote:

So do we consider this to be an OpenSSL issue of gajim? I'm sure
gajim is not the only program that does something like this.

As far as I understand things, it is not necessarily at all to set
a verification callback in OpenSSL.  If you load the root
certificate store and examine SSL_get_verify_result, that should be
sufficient.  You can even look at the peer certificate and continue
anyway if the user has overridden the certificate validity.  So
far, I haven't found a good reason to use a verify callback at all.
You need it to implement a custom PKIX validation policy, but that
should be pretty rare.  (I still have to check older OpenSSL
versions, though, perhaps there, the behavior was different.)

Anyway, if application developers set a verification callback, it
is their responsibility to implement it correctly.  Therefore, I
don't think this is an OpenSSL issue.

Makes sense, just wanted to confirm this problem resides within Gajim.
Please use CVE-2012-5524 for this issue.

Regarding the OpenSSL behavior, there appears to be a related bug report:

<http://rt.openssl.org/Ticket/Display.html?id=2768&user=guest&pass=guest>

--
Florian Weimer / Red Hat Product Security Team


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]