Home page logo

oss-sec logo oss-sec mailing list archives

CVE request: flaw in curl's Windows SSL backend
From: Daniel Stenberg <daniel () haxx se>
Date: Mon, 17 Mar 2014 15:16:12 +0100 (CET)


I'd like to ask for a CVE for a newly discovered problem in curl's functionality that verifies server certificates. The problem is present in code only runnning on Windows when using the schannel SSL backend. It is very similar to the Mac-specific curl problem Apple registered CVE-2014-1263 for, but for another backend and platform.

I don't think it is a good idea to "pile up" another bug on an existing CVE so a new one is probably needed.

For this reason, I do not request this on distros@ or linux-distros@ since this problem does not affect any opensource distro. This is for an open source product executing on Windows.

We intend to announce the full details in sync the pending curl release on March 26.


 / daniel.haxx.se

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]