From mboxrd@z Thu Jan 1 00:00:00 1970 From: Vincent Legoll Subject: Re: GnuTLS security update Date: Sun, 11 Sep 2016 18:08:27 +0200 Message-ID: References: <20160911154108.GA13920@jasmine> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:49960) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bj7KN-0002XM-Ug for guix-devel@gnu.org; Sun, 11 Sep 2016 12:09:56 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bj7KH-0006JZ-Th for guix-devel@gnu.org; Sun, 11 Sep 2016 12:09:54 -0400 Received: from mail-qk0-f169.google.com ([209.85.220.169]:33732) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bj7KH-0006G5-Q2 for guix-devel@gnu.org; Sun, 11 Sep 2016 12:09:49 -0400 Received: by mail-qk0-f169.google.com with SMTP id w204so122369787qka.0 for ; Sun, 11 Sep 2016 09:09:28 -0700 (PDT) In-Reply-To: <20160911154108.GA13920@jasmine> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: guix-devel On Sun, Sep 11, 2016 at 5:41 PM, Leo Famulari wrote: > There is a GnuTLS security advisory [0] regarding "an issue that affects > validation of certificates using OCSP responses, which can falsely > report a certificate as valid under certain circumstances." > > I updated GnuTLS on core-updates to 3.5.4, the latest release of the 3.5 > series. > > For master, the naive approach of cherry-picking the patch [1] did not > work; the test 'system-prio-file' fails consistently with that change. I > could instead try grafting the updated version. > > What do you think? The authors seem to think it's a relatively minor > issue [2], since exploiting it requires an attacker to compromise the > certificate authority. Side questions (just for my curiosity's sake): - What does it cost (manpower, hydra build time, etc...) approximatively to do a new release ? - Is it sufficiently automated ? - Can we help ? -- Vincent Legoll