[Bug 758431] New: Midori does not display whether SSL certificates are valid

newer
[Bug 758024] New: 'findif' doesn't...

older
[Bug 758430] New: Midori crashes...

bugzilla_noreply＠novell.com

22 Apr 2012 22 Apr '12

08:52

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c0 Summary: Midori does not display whether SSL certificates are valid Classification: openSUSE Product: openSUSE 11.4 Version: Factory Platform: Other OS/Version: openSUSE 11.4 Status: NEW Severity: Normal Priority: P5 - None Component: Xfce AssignedTo: bnc-team-xfce@forge.provo.novell.com ReportedBy: gber@opensuse.org QAContact: qa-bugs@suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:11.0) Gecko/20100101 Firefox/11.0 Midori before version 0.4.2 does not display whether SSL certificates are valid because it lacks a dependency on the ca-cartificates package and does not set the openSUSE specific path to the certificate bundle file. Reproducible: Always -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Show replies by date

bugzilla_noreply＠novell.com

22 Apr 22 Apr

09:01

New subject: [Bug 758431] Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c Guido Berhörster changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://launchpad.net/bugs/ | |874592 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

23 Apr 23 Apr

08:45

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c1 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Midori does not display |VUL-0: Midori does not |whether SSL certificates |display whether SSL |are valid |certificates are valid --- Comment #1 from Ludwig Nussel 2012-04-23 10:45:31 CEST --- Worst of all, it still displays the address bar as being secure. it must not do that if it doesn't actually do any verification. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

09:23

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c2 --- Comment #2 from Ludwig Nussel 2012-04-23 11:23:58 CEST --- I think you should to set "ssl-use-system-ca-file" and "ssl-strict" instead of adding bundle files. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

09:54

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c3 --- Comment #3 from Guido Berhörster 2012-04-23 09:54:11 UTC --- (In reply to comment #1)

...

Worst of all, it still displays the address bar as being secure. it must not do that if it doesn't actually do any verification.

I'm not sure any more whether this problem is actually caused by Midori. This happens only with 0.3.0 in openSUSE 11.4 and looking at the corresponding code there is a check in webkit_web_view_load_committed_cb() whether the certificate is trusted or not: WebKitWebDataSource *source; WebKitNetworkRequest *request; SoupMessage *message; source = webkit_web_frame_get_data_source (web_frame); request = webkit_web_data_source_get_request (source); message = webkit_network_request_get_message (request); if (message && soup_message_get_flags (message) & SOUP_MESSAGE_CERTIFICATE_TRUSTED) view->security = MIDORI_SECURITY_TRUSTED; else #endif view->security = MIDORI_SECURITY_UNKNOWN; (see http://git.xfce.org/apps/midori/tree/midori/midori-view.c?id=0.3.0#n1020) When tracing that with gdb soup_message_get_flags (message) seems to return a random value. Now the above code has not changed at all in Midori 0.4.1 in openSUSE 12.1 but soup_message_get_flags (message) returns a valid value causing Midori to correctly mark the certificate as untrusted. Somebody familiar with libsoup should probably look at this to see whether Midori or libsoup 2.32.2 is at fault here. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

10:01

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c4 --- Comment #4 from Guido Berhörster 2012-04-23 10:01:54 UTC --- (In reply to comment #2)

...

I think you should to set "ssl-use-system-ca-file" and "ssl-strict" instead of adding bundle files.

No, ssl-use-system-ca-file was introduced with libsoup 2.38 whereas oS 11.4 has 2.32.1 and 12.1 has 2.36.1. ssl-strict makes no sense, the browser needs to handle certificate validity itself. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

10:02

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c Guido Berhörster changed: What |Removed |Added ---------------------------------------------------------------------------- See Also|https://launchpad.net/bugs/ | |874592 | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

15:17

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c5 --- Comment #5 from Ludwig Nussel 2012-04-23 17:17:55 CEST --- if the version in 11.3 cannot be fixed to correctly display the trusted flag it should display untrusted always. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

18:16

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c6 Guido Berhörster changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bnc-team-gnome@forge.provo. | |novell.com --- Comment #6 from Guido Berhörster 2012-04-23 18:16:03 UTC --- (In reply to comment #5)

...

if the version in 11.3 cannot be fixed to correctly display the trusted flag it should display untrusted always.

I don't see anything outright wrong with the code in midori. I just built midori 0.3.0 for 12.1 and checked there with gdb, soup_message_get_flags() always returns a correct value of 0 when the certificate bundle cannot be found, i.e. SOUP_MESSAGE_CERTIFICATE_TRUSTED is not set. I think one of the gnome maintainers should look into this. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

18:56

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c7 --- Comment #7 from Vincent Untz 2012-04-23 18:56:10 UTC --- I suggest to look at the epiphany code. For reference, in 11.3, 11.4 and 12.1, we pass --with-ca-file=%{_sysconfdir}/ssl/ca-bundle.pem to epiphany. So epiphany was doing something with the ca file (look for GTLS_SYSTEM_CA_FILE in embed/ephy-embed.c and embed/ephy-embed-single.c -- it seems it's setting the ssl-ca-file property of the libsoup session object). In 11.2, we had epiphany-https-unknown-security.patch with was forcing the use of EPHY_WEB_VIEW_STATE_IS_UNKNOWN all the time. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

22:00

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c8 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium --- Comment #8 from Swamp Workflow Management 2012-04-23 22:00:07 UTC --- bugbot adjusting priority -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

22:38

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c9 --- Comment #9 from Guido Berhörster 2012-04-23 22:38:45 UTC --- (In reply to comment #7)

...

I suggest to look at the epiphany code.

For reference, in 11.3, 11.4 and 12.1, we pass --with-ca-file=%{_sysconfdir}/ssl/ca-bundle.pem to epiphany. So epiphany was doing something with the ca file (look for GTLS_SYSTEM_CA_FILE in embed/ephy-embed.c and embed/ephy-embed-single.c -- it seems it's setting the ssl-ca-file property of the libsoup session object).

Midori has equivalent code for setting ssl-ca-file but checks for the file at runtime. The problem is that when it does not set the ssl-ca-file property because no bundle file is installed, soup_message_get_flags() from libsoup 2.32.2 in 11.4 returns a random number. A random number >= 32 means that the SOUP_MESSAGE_CERTIFICATE_TRUSTED is set, indicating a valid certificate while it actually has not been verified. With the later libsoup versions in 12.1 and Factory soup_message_get_flags() correctly returns 0, ie. the above flag not set as it should when it cannot verify its validity.

...

In 11.2, we had epiphany-https-unknown-security.patch with was forcing the use of EPHY_WEB_VIEW_STATE_IS_UNKNOWN all the time.

I can surely create such a patch specifically for midori in 11.4 treating all certificates as unverified, however since this seems like a libsoup bug it might affect other consumers? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

22:46

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c10 --- Comment #10 from Guido Berhörster 2012-04-23 22:46:09 UTC --- I just checked with epiphany on 11.4, it suffers from the same problem, without the certificate bundle installed it marks invalid certificates with "Security level: High". So this needs to be fixed in libsoup. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

24 Apr 24 Apr

07:51

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c12 --- Comment #12 from Guido Berhörster 2012-04-24 07:51:01 UTC --- (In reply to comment #9)

...

2.32.2 in 11.4 returns a random number. A random number >= 32 means that the SOUP_MESSAGE_CERTIFICATE_TRUSTED is set, indicating a valid certificate while

Hrm, that should of course read "A number with the 5th bit (SOUP_MESSAGE_CERTIFICATE_TRUSTED) set indicates a valid certificate..." Looking at the libsoup code it seems that when starting a SSL connection soup-socket.c:soup_socket_start_proxy_ssl() trusts certificates by default and relies on soup-socket.c:soup_socket_write()/read_from_network() receiving a SOUP_SSL_ERROR_CERTIFICATE to mark the certificate untrusted. However, that never happens when a CA certificate bundle has not been passed in because soup-gnutls.c:do_handshake() then does not do any verification by calling soup-gnutls.c:verify_certificate() which can raise a SOUP_SSL_ERROR_CERTIFICATE. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

08:00

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c13 --- Comment #13 from Ludwig Nussel 2012-04-24 10:00:35 CEST --- that fail-open behavior certainly isn't the smartest. Also have_ca_file() is deliberately skipped if have_ca_file is FALSE. Maybe patching that constraint out already fixes the issue. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

08:07

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c14 Vincent Untz changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |vuntz@suse.com --- Comment #14 from Vincent Untz 2012-04-24 08:07:37 UTC --- Ah, I missed the fact that this is happening when ca-certificates is not installed. One non-intrusive solution is simple: just add a Requires on ca-certificates. We should really do that anyway (not just for Midori). As to changing libsoup... I've been looking at it this morning. I came to a similar conclusion about do_handshake(), and I'm waiting for OBS to build my package to test (home:vuntz:11.4-testing). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

08:10

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c15 --- Comment #15 from Ludwig Nussel 2012-04-24 10:10:11 CEST --- ca-certificates is installed by default but libsoup was not configured to use the correct ca file. To catch such errors it must behave fail-close. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

08:55

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c16 --- Comment #16 from Ludwig Nussel 2012-04-24 10:55:06 CEST --- Note on 12.1 the situation is different. looks like libsoup automatically uses the system certificates via glib. So the warning about the missing ca file in midory is misleading. midori does not need to actually set a ca file there. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

09:06

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c17 --- Comment #17 from Vincent Untz 2012-04-24 09:06:21 UTC --- (In reply to comment #15)

...

ca-certificates is installed by default but libsoup was not configured to use the correct ca file. To catch such errors it must behave fail-close.

I'm not sure what you mean here. My reading of the code is that if the specified ca file doesn't exist, gnutls will handle this gracefully: status = gnutls_certificate_set_x509_trust_file ( creds->creds, ca_file, GNUTLS_X509_FMT_PEM); if (status < 0) { g_warning ("Failed to set SSL trust file (%s).", ca_file); /* Since we set have_ca_file though, this just * means that no certs will validate, so we're * ok securitywise if we just return these * creds to the caller. */ } -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

09:26

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c18 --- Comment #18 from Ludwig Nussel 2012-04-24 11:26:18 CEST --- Created an attachment (id=487674) --> (http://bugzilla.novell.com/attachment.cgi?id=487674) patch patch enable certificate verification even if no ca-file is used. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

09:41

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c19 --- Comment #19 from Vincent Untz 2012-04-24 09:41:37 UTC --- (In reply to comment #18)

...

Created an attachment (id=487674) --> (http://bugzilla.novell.com/attachment.cgi?id=487674) [details] patch

patch enable certificate verification even if no ca-file is used.

I think my patch in home:vuntz:11.4-testing is a better approach -- if there's no ca file, there's no need to even try to validate the certificate. We just always error out. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

09:53

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c20 --- Comment #20 from Ludwig Nussel 2012-04-24 11:53:22 CEST --- ah, missed to look at your patch. end result is the same so feel free to submit -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

15:43

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c21 --- Comment #21 from Vincent Untz 2012-04-24 15:43:56 UTC --- Now that OBS finally published the packages... This seems to work fine, but I found that epiphany is using the strict ssl mode when the ca file doesn't exist: it won't even try to load the page. So patching epiphany for this in home:vuntz:11.4-testing. Guido, can you try the libsoup package? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

17:04

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c22 --- Comment #22 from Guido Berhörster 2012-04-24 17:04:31 UTC --- (In reply to comment #21)

...

Now that OBS finally published the packages... This seems to work fine, but I found that epiphany is using the strict ssl mode when the ca file doesn't exist: it won't even try to load the page. So patching epiphany for this in home:vuntz:11.4-testing.

Guido, can you try the libsoup package?

Same issue with midori apparently, I need to patch it as well. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

20:41

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c23 --- Comment #23 from Vincent Untz 2012-04-24 20:40:59 UTC --- Confirming that my patched epiphany works as expected. Should we submit everything at once? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

25 Apr 25 Apr

08:43

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c24 --- Comment #24 from Vincent Untz 2012-04-25 08:43:39 UTC --- I submitted sr#115273 and sr#115274. I guess we want midori too. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

10:07

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c25 --- Comment #25 from Guido Berhörster 2012-04-25 10:07:29 UTC --- The fix for midori is mr#115289. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

11:03

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c26 Vincent Untz changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|bnc-team-xfce@forge.provo.n |security-team@suse.de |ovell.com | --- Comment #26 from Vincent Untz 2012-04-25 11:03:51 UTC --- (assigning to security team now that we have submitted everything) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

11:31

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c27 --- Comment #27 from Ludwig Nussel 2012-04-25 13:31:06 CEST --- CVE-2012-2132 for libsoup -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

12:46

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard| |obs:running:477:moderate -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

3 May 3 May

13:56

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c28 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |meissner@suse.com --- Comment #28 from Marcus Meissner 2012-05-03 13:56:23 UTC --- https://bugzilla.gnome.org/show_bug.cgi?id=666280 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

14:04

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c29 --- Comment #29 from Marcus Meissner 2012-05-03 14:04:49 UTC --- sle11 sp2 has libsoup 2.32.2, so would have this problem. so we should turn it to the different default behaviour to catch problems. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

14:06

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c30 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|obs:running:477:moderate |obs:running:477:moderate | |maint:running:47159:moderat | |e --- Comment #30 from Swamp Workflow Management 2012-05-03 14:06:37 UTC --- The SWAMPID for this issue is 47159. This issue was rated as moderate. Please submit fixed packages until 2012-05-17. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

14:36

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |760517 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

4 May 4 May

09:28

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c31 --- Comment #31 from Ludwig Nussel 2012-05-04 11:28:55 CEST --- Dan Winship suggested to use a different patch https://bugzilla.redhat.com/attachment.cgi?id=581443&action=diff This patch marks the connection as untrusted but does not terminate it if no ca file was specified. To avoid having to patch a ca file option into each and every application I'd suggest to make libsoup use a default always if nothing is specified. Since we did not have a ca bundle file before 11.3 and the bundle file is considered deprecated libsoup needs to read /etc/ssl/certs/*.pem instead. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

11:05

New subject: [Bug 758431] VUL-0: Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c32 --- Comment #32 from Ludwig Nussel 2012-05-04 13:05:08 CEST --- Created an attachment (id=489556) --> (http://bugzilla.novell.com/attachment.cgi?id=489556) patch for 2.32.2 to read /etc/ssl/certs as fallback -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

19:49

New subject: [Bug 758431] VUL-0: libsoup does not handle SSL certs / Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c33 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|VUL-0: Midori does not |VUL-0: libsoup does not |display whether SSL |handle SSL certs / Midori |certificates are valid |does not display whether | |SSL certificates are valid --- Comment #33 from Marcus Meissner 2012-05-04 19:49:02 UTC --- For the libsoup fix: CVE-2012-2132 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

7 May 7 May

14:55

New subject: [Bug 758431] VUL-0: libsoup does not handle SSL certs / Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c34 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|security-team@suse.de |vuntz@suse.com --- Comment #34 from Ludwig Nussel 2012-05-07 16:55:07 CEST --- we should apply the patch from comment #32 regardless of upstream position to avoid having to patch all kinds of applications. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

10 May 10 May

14:15

New subject: [Bug 758431] VUL-0: libsoup does not handle SSL certs / Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|obs:running:477:moderate |maint:running:47159:moderat |maint:running:47159:moderat |e |e | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

14:22

New subject: [Bug 758431] VUL-0: libsoup does not handle SSL certs / Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c35 --- Comment #35 from Ludwig Nussel 2012-05-10 16:22:32 CEST --- I've filed an enhancement request to backport gnutls_certificate_set_x509_system_trust(): bug 761634 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

15:09

New subject: [Bug 758431] VUL-0: libsoup does not handle SSL certs / Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c36 --- Comment #36 from Swamp Workflow Management 2012-05-10 15:09:25 UTC --- openSUSE-SU-2012:0609-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 758431 CVE References: CVE-2012-2132 Sources used: openSUSE 11.4 (src): epiphany-2.30.6-14.1, libsoup-2.32.2-3.12.1, midori-0.3.0-7.13.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

14 May 14 May

09:34

New subject: [Bug 758431] VUL-0: libsoup does not handle SSL certs / Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |752088 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

21 May 21 May

09:09

New subject: [Bug 758431] VUL-0: libsoup does not handle SSL certs / Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c37 --- Comment #37 from Benjamin Brunner 2012-05-21 11:09:47 CEST --- The midori-update for 12.1 is released. Can we close this bug now or is something missing? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

09:18

New subject: [Bug 758431] VUL-0: libsoup does not handle SSL certs / Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c38 --- Comment #38 from Ludwig Nussel 2012-05-21 11:18:46 CEST --- changing libsoup's default behavior is still open -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

10:08

New subject: [Bug 758431] VUL-0: libsoup does not handle SSL certs / Midori does not display whether SSL certificates are valid

https://bugzilla.novell.com/show_bug.cgi?id=758431 https://bugzilla.novell.com/show_bug.cgi?id=758431#c39 --- Comment #39 from Swamp Workflow Management 2012-05-21 10:08:38 UTC --- openSUSE-RU-2012:0633-1: An update that has two recommended fixes can now be installed. Category: recommended (low) Bug References: 758430,758431 CVE References: Sources used: openSUSE 12.1 (src): midori-0.4.1-2.4.2 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

4362

Age (days ago)

4391

Last active (days ago)

List overview

Download

44 comments

1 participants

participants (1)

bugzilla_noreply＠novell.com

[Bug 758431] New: Midori does not display whether SSL certificates are valid

tags

participants (1)