Your message dated Mon, 2 Nov 2009 20:35:18 +0100
with message-id <20091102193518.ga17...@galadriel.inutil.org>
and subject line Re: CVE-2009-3766: missing host name vs. SSL certificate name
checks
has caused the Debian Bug report #553433,
regarding CVE-2009-3766: missing host name vs. SSL certificate name checks
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
553433: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=553433
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: mutt
Severity: grave
Tags: security
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for mutt.
CVE-2009-3766[0]:
| mutt_ssl.c in mutt 1.5.16, when OpenSSL is used, does not verify the
| domain name in the subject's Common Name (CN) field of an X.509
| certificate, which allows man-in-the-middle attackers to spoof SSL
| servers via an arbitrary valid certificate.
Please coordinate with the security team (t...@security.debian.org) to
prepare packages for the stable and oldstable releases.
If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.
For further information see:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3766
http://security-tracker.debian.org/tracker/CVE-2009-3766
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAkrsCwsACgkQNxpp46476ap7UQCfXTB25r/gpBnXfDTBT0dI1IcK
ETYAnjJTfCnifLMUmqb90U+RO+mSqIjF
=xxZh
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
On Sat, Oct 31, 2009 at 11:01:50AM +0100, Giuseppe Iuculano wrote:
>
> CVE-2009-3766[0]:
> | mutt_ssl.c in mutt 1.5.16, when OpenSSL is used, does not verify the
> | domain name in the subject's Common Name (CN) field of an X.509
> | certificate, which allows man-in-the-middle attackers to spoof SSL
> | servers via an arbitrary valid certificate.
>
> Please coordinate with the security team (t...@security.debian.org) to
> prepare packages for the stable and oldstable releases.
The current unstable version, the version in Lenny and Etch all build
with "--with-gnutls", closing.
Cheers,
Moritz
--- End Message ---
