CVE-2013-4353 and CVSS v2 vector with Authentication set to None

Hi, I am analyzing CVE-2013-4353, and the CVSS vector mentions Au parameter to N [1] From what I understand, the culprit code is called in the Server Finish message of the handshake, which is the last step - by this time the client has authenticated the server (step 3). So why does the CVSS vector

[no subject]

Hi, We had a product which generate RSA/MD5 certificate. Now I'm working on a custom openssl engine. The goal is to generate X509 certificate with some new signature/digest algorithms. With engine, we do not need to re-code too much. Now we can generate and sign certificate, but X509_verify() fai

EVP_get_digestbynid() and ENGINE_get_digest()

Hi, We had a product which generate RSA/MD5 certificate. Now I'm working on a custom openssl engine. The goal is to generate X509 certificate with some new signature/digest algorithms. With engine, we do not need to re-code too much. Now we can generate and sign certificate, but X509_verify() fai