From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: [PATCH 0/1] Update curl replacement to 7.50.2 Date: Wed, 7 Sep 2016 18:04:22 -0400 Message-ID: Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:34876) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bhkxX-0007rp-Eb for guix-devel@gnu.org; Wed, 07 Sep 2016 18:04:44 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bhkxT-0004eX-Bs for guix-devel@gnu.org; Wed, 07 Sep 2016 18:04:43 -0400 Received: from out4-smtp.messagingengine.com ([66.111.4.28]:47422) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bhkxR-0004cZ-UJ for guix-devel@gnu.org; Wed, 07 Sep 2016 18:04:39 -0400 Received: from localhost.localdomain (c-73-188-17-148.hsd1.pa.comcast.net [73.188.17.148]) by mail.messagingengine.com (Postfix) with ESMTPA id 4CB68CCE69 for ; Wed, 7 Sep 2016 18:04:28 -0400 (EDT) List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org The curl project disclosed a bug, CVE-2016-7141 [0]: --- libcurl built on top of NSS (Network Security Services) incorrectly re-used client certificates if a certificate from file was used for one TLS connection but no certificate set for a subsequent TLS connection. While the symptoms are similar to CVE-2016-5420 (Re-using connection with wrong client cert), this vulnerability was caused by an implementation detail of the NSS backend in libcurl, which is orthogonal to the cause of CVE-2016-5420. --- As far as I can tell, our curl package does not use NSS, but people who use Guix as a source of free software source code (`guix build --source`) may be vulnerable. [0] http://seclists.org/oss-sec/2016/q3/433 https://curl.haxx.se/docs/vuln-7.50.1.html Leo Famulari (1): gnu: curl: Update replacement to 7.50.2 [fixes CVE-2016-7141]. gnu/packages/curl.scm | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) -- 2.10.0