https://bugzilla.novell.com/show_bug.cgi?id=467911 Summary: in gnutls the CVE-2008-4989 patch causes segfault with certain certificates (as used by libprelude) Classification: openSUSE Product: openSUSE 11.1 Version: RC 2 Platform: i586 OS/Version: openSUSE 11.1 Status: NEW Severity: Major Priority: P5 - None Component: Security AssignedTo: security-team@suse.de ReportedBy: ag@pre-secure.de QAContact: qa@suse.de Found By: --- User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.5) Gecko/2008121300 SUSE/3.0.5-1.1 Firefox/3.0.5 i already reported this here: http://lists.gnu.org/archive/html/gnutls-devel/2009-01/msg00050.html and got this reply: http://lists.gnu.org/archive/html/gnutls-devel/2009-01/msg00051.html i was debugging a segfault in an application that uses libprelude which in turn uses gnutls. the system is opensuse 11.1 with gnutls-2.4.1. the client application segfaulted upon connection to a server. after some fiddling, i found out that this segfault was caused by the CVE-2008-4989 patch http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217 that was added by opensuse to the gnutls-2.4.1 RPM. using a plain, selfcompiled gnutls-2.4.1 worked fine. gnutls-2.6.3 worked fine as well. the segfault also happens just using gnutls-cli to connect so its not a problem of libprelude. i can provide a certificate and a server to reproduce this segfault, if needed. the segfault just seems to happen with certain server- and ca-certificates. connecting to a regular https-server worked fine. i dont know enough of gnutls-internals to really figure out what the problem is, but it would be neat if this segfault could be fixed in 2.4.x. since 2.6.3 does not segfault, there seems to be a way to fix the vulnerability without this segfault... Reproducible: Always -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.