[Bug 1082814] New: VUL-0: CVE-2012-6709 elinks: Does not properly verify SSL certificates
http://bugzilla.opensuse.org/show_bug.cgi?id=1082814 Bug ID: 1082814 Summary: VUL-0: CVE-2012-6709 elinks: Does not properly verify SSL certificates Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/200756/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: puzel@suse.com Reporter: jsegitz@suse.com QA Contact: security-team@suse.de Found By: Security Response Team Blocker: ---
From Vincent Danen
A Debian bug report [1] indicated that Links does not properly verify SSL certificates. If you visit a web site with an expired SSL certificate, Links will only display "SSL error" without any indication as to what the error was. This, in and of itself, is not a flaw however when testing, I found that when you go to a site with a valid SSL certificate, but for a different hostname (for example, if you go to https://alias.foo.com which might be a CNAME or a proxy for https://foo.com) Links will connect without any errors or warnings. Doing the same in a browser like Google Chrome, however, reports "You attempted to reach alias.foo.com, but instead you actually reached a server identifying itself as foo.com." and allows you to either proceed or not, before loading the site. elinks https://wrong.host.badssl.com/ opens without warning References: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=694658 https://bugzilla.redhat.com/show_bug.cgi?id=881399 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6709 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=694658 -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1082814 http://bugzilla.opensuse.org/show_bug.cgi?id=1082814#c4 Sébastien POHER <sogal@opensuse.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sogal@opensuse.org --- Comment #4 from Sébastien POHER <sogal@opensuse.org> --- Hi all, The latest 0.13 version that can be found here [0] seems to fix the issue. When browsing one of : * https://wrong.host.badssl.com/ * https://self-signed.badssl.com/ * https://untrusted-root.badssl.com/ You now get a clear warning "Unable to get https://domain.tld: SSL Error / Retry without verification ?" and the ability to quit the connection or bypass the warning and go on. I have build a test version here [1] if someone what to try it. Regards, [0] http://elinks.or.cz/download.html [1] https://build.opensuse.org/package/show/home:sogal/elinks -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1082814 http://bugzilla.opensuse.org/show_bug.cgi?id=1082814#c10 Andreas Stieger <Andreas.Stieger@gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |Andreas.Stieger@gmx.de --- Comment #10 from Andreas Stieger <Andreas.Stieger@gmx.de> --- ping -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com