diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2016-04-24 17:52:18 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2016-05-17 14:48:17 +0200 |
| commit | 6efd2fa529a189bf41736a610f6184cd8ad94b4d (patch) | |
| tree | 2172e87706b045a5e8d9ea412c6bce9b2b33f86a /CHANGES.0 | |
| parent | 5db313985e502e82a3eed03396ee600b726d60c2 (diff) | |
mbedtls/polarssl: set "hostname" unconditionally
...as otherwise the TLS libs will skip the CN/SAN check and just allow
connection to any server. curl previously skipped this function when SNI
wasn't used or when connecting to an IP address specified host.
CVE-2016-3739
Bug: https://curl.haxx.se/docs/adv_20160518A.html
Reported-by: Moti Avrahami
Diffstat (limited to 'CHANGES.0')
0 files changed, 0 insertions, 0 deletions