aboutsummaryrefslogtreecommitdiff
path: root/maketgz
diff options
context:
space:
mode:
authorDaniel Stenberg <daniel@haxx.se>2009-08-01 21:56:59 +0000
committerDaniel Stenberg <daniel@haxx.se>2009-08-01 21:56:59 +0000
commitc0e8bed5bf7a7e56897e492a4dcc399621939995 (patch)
tree5c5262804a2a51a53d69e1b66411a03612e5a929 /maketgz
parent0dce2ff8a09065b2be2a3531f498006906c81db5 (diff)
- Scott Cantor posted the bug report #2829955
(http://curl.haxx.se/bug/view.cgi?id=2829955) mentioning the recent SSL cert verification flaw found and exploited by Moxie Marlinspike. The presentation he did at Black Hat is available here: https://www.blackhat.com/html/bh-usa-09/bh-usa-09-archives.html#Marlinspike Apparently at least one CA allowed a subjectAltName or CN that contain a zero byte, and thus clients that assumed they would never have zero bytes were exploited to OK a certificate that didn't actually match the site. Like if the name in the cert was "example.com\0theatualsite.com", libcurl would happily verify that cert for example.com. libcurl now better use the length of the extracted name, not assuming it is zero terminated.
Diffstat (limited to 'maketgz')
0 files changed, 0 insertions, 0 deletions