From mboxrd@z Thu Jan 1 00:00:00 1970 From: ng0 Subject: Re: [PATCH 0/1] curl: Fix CVE-2016-3739. Date: Mon, 13 Jun 2016 15:42:47 +0000 Message-ID: <20160613154247.GB4065@khazad-dum> References: <87inxei119.fsf@gnu.org> <20160612210232.GA5479@khazad-dum> <20160613011231.GA13522@jasmine> <87eg81cel0.fsf@gnu.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="VrqPEDrXMn8OVzN4" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:42620) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bCU0z-0001bF-Rm for guix-devel@gnu.org; Mon, 13 Jun 2016 11:43:02 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bCU0t-0006jq-Ca for guix-devel@gnu.org; Mon, 13 Jun 2016 11:43:00 -0400 Received: from 93-95-228-168.1984.is ([93.95.228.168]:45741 helo=beleriand.n0.is) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bCU0s-0006jc-VG for guix-devel@gnu.org; Mon, 13 Jun 2016 11:42:55 -0400 Received: by beleriand.n0.is (OpenSMTPD) with ESMTPSA id 69f26e43 TLS version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO for ; Mon, 13 Jun 2016 15:42:51 +0000 (UTC) Content-Disposition: inline In-Reply-To: <87eg81cel0.fsf@gnu.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org --VrqPEDrXMn8OVzN4 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 2016-06-13(05:07:23+0200), Ludovic Court=C3=A8s wrote: > Leo Famulari skribis: > > > On Sun, Jun 12, 2016 at 09:02:32PM +0000, ng0 wrote: > >> On 2016-06-12(10:51:14+0200), Ludovic Court=C3=A8s wrote: > >> > Leo Famulari skribis: > >> > > >> > > If your SSL / TLS provider is mbedTLS (formerly PolarSSL), there i= s a > >> > > bug in curl [CVE-2016-3739] that allows an attacker to bypass the = full > >> > > certificate check by presenting any valid certificate. > >> > > > >> > > So, you might think are connecting to https://example.com, when in= fact > >> > > the attacker has a certificate for any other domain. > >> > > > >> > > We don't package mbedTLS, but I still think we should provide the = fixed > >> > > source code. > >> > > >> > OTOH this will incur additional grafting for no reason, WDYT? > > > > No reason for things built within our distribution, true. > > Right. > > >> fyi, > >> > >> mbedtls is on my list of packages to do, as the webserver hiawatha > >> depends on it. > >> > >> Should I announce once it is packaged and the cve fix can be applied > >> afterwards? > > > > We should definitely update curl on core-updates-next, or whatever is > > built after the current cycle, and we should not add hiawatha until the > > fixed curl is in our tree. > > Agreed on both points. Can you already push the curl update in > core-updates-next? > > Though I would like the default curl package to still used GnuTLS. So I > think curl-with-mbedtls will be a different package anyway. > > Thanks, > Ludo=E2=80=99. > =46rom the way it was done in Gentoo, I assume this is not needed? mbedtls is a separate package, and I have libressl as the curlssl provider, which is a curl built against libressl. If I am wrong, correct me. My initial comment was a bit out of place, but I just assume it will justwork=E2=84=A2 on guix, otherwise a curl-with-mbedtls would have to be created. Sorry for the confusion. -- =E2=99=A5=E2=92=B6 ng0 For non-prism friendly talk find me on psyced.org / loupsycedyglgamf.onion --VrqPEDrXMn8OVzN4 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- iF4EARYKAAYFAlde1HcACgkQhhoAchyzrCCs0gEAxUMFRJBvfnZiIQN8mJfAcj3U osRuUgpn835jtr+q3hcA/1iPCGJtAdYG/qZNA8IDGqzIi3T7F/quc1oFSV+MBsUH =6o2v -----END PGP SIGNATURE----- --VrqPEDrXMn8OVzN4--