[ curl-Bugs-2829955 ] Wildcard cert name checking and null termination (fwd)
Date: Fri, 31 Jul 2009 10:09:14 +0200 (CEST)
I'm especially forwarding this from the tracker to get some more eyeballs on
"There's a new wildcard cert attack made public here:
I took a pass over the name matching code, and unless something in openssl
or the code that gets at the subject names is somehow immune, the matching
logic seems to be vulnerable. If not, feel free to close."
I'll get on on the case soon as well, but feel encouraged to join in and help!
Received on 2009-07-31