[Bug 625384] New: Can't use osc securely
http://bugzilla.novell.com/show_bug.cgi?id=625384 http://bugzilla.novell.com/show_bug.cgi?id=625384#c0 Summary: Can't use osc securely Classification: openSUSE Product: openSUSE 11.3 Version: Final Platform: Other OS/Version: Other Status: NEW Severity: Major Priority: P5 - None Component: Development AssignedTo: pth@novell.com ReportedBy: lkundrak@v3.sk QAContact: qa@suse.de Found By: --- Blocker: --- Created an attachment (id=378221) --> (http://bugzilla.novell.com/attachment.cgi?id=378221) deep recursion User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.4) Gecko/20100622 Fedora/3.6.4-2.fc14 Firefox/3.6.4 I booted a openSUSE 11.3 live GNOME media and run "zypper in osc". I've encountered two problem but they are possibly related thus opening a single bug report. 1.) Upon first run the certificate was untrusted: lkundrak@linux:~> osc ls *** certificate verify failed at depth 0 Subject: /serialNumber=Z5rnYBfW36qc6oVoHaO0ceAbfvr3w6Oa/C=US/ST=Utah/L=Provo/O=Novell, Inc./CN=*.opensuse.org Issuer: /C=US/O=Equifax/OU=Equifax Secure Certificate Authority .. This is possibly a rather serious security problem -- public certificate of the authority that signed the certificate should be trusted by default. Or, at the very least, a securie way to verify the fingerprint of the certificate should be provided (I am not aware of any). 2.) osc does not work at all, deep recursion somewhere in crypto code. I am attaching the traceback as an attachment, since given it's from infinite recursion and thus is quite long :) Reproducible: Always Steps to Reproduce: 1. 2. 3. lkundrak@kutanoid-wlan:~> rpm -q osc osc-0.128-17.1.noarch tried with 0.127 as well. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
http://bugzilla.novell.com/show_bug.cgi?id=625384 http://bugzilla.novell.com/show_bug.cgi?id=625384#c1 Marcus Meissner <meissner@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |meissner@novell.com AssignedTo|pth@novell.com |lnussel@novell.com --- Comment #1 from Marcus Meissner <meissner@novell.com> 2010-07-26 07:44:55 UTC --- This root cert should be in the standard certificate lists though , and I think we would have seen this ... reassign to Ludwig who knows the code. (he is on vacation this week, but will be next week) -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
http://bugzilla.novell.com/show_bug.cgi?id=625384 http://bugzilla.novell.com/show_bug.cgi?id=625384#c2 Ludwig Nussel <lnussel@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO InfoProvider| |lkundrak@v3.sk --- Comment #2 from Ludwig Nussel <lnussel@novell.com> 2010-08-02 11:30:37 CEST --- (In reply to comment #0)
1.) Upon first run the certificate was untrusted:
lkundrak@linux:~> osc ls *** certificate verify failed at depth 0 Subject: /serialNumber=Z5rnYBfW36qc6oVoHaO0ceAbfvr3w6Oa/C=US/ST=Utah/L=Provo/O=Novell, Inc./CN=*.opensuse.org Issuer: /C=US/O=Equifax/OU=Equifax Secure Certificate Authority ...
This is possibly a rather serious security problem -- public certificate of the authority that signed the certificate should be trusted by default. Or, at the very least, a securie way to verify the fingerprint of the certificate should be provided (I am not aware of any).
/etc/ssl/certs/Equifax_Secure_CA.pem from package ca-certificates-mozilla is installed by default also on the live CDs. Are you sure the problem is an untrusted CA? What's the full output of osc? Did you install any packages from 3rd party repos (osc is from openSUSE:Tools I guess)?
2.) osc does not work at all, deep recursion somewhere in crypto code. I am attaching the traceback as an attachment, since given it's from infinite recursion and thus is quite long :)
No idea how that can happen. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=625384 https://bugzilla.novell.com/show_bug.cgi?id=625384#c3 Ludwig Nussel <lnussel@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |RESOLVED InfoProvider|lkundrak@v3.sk | Resolution| |NORESPONSE --- Comment #3 from Ludwig Nussel <lnussel@novell.com> 2011-01-11 13:38:19 CET --- no response -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com