Re: CVE-2009-3555 not addressed in OpenSSL

To: Simon Josefsson <simon@josefsson.org>
Cc: Marsh Ray <marsh@extendedsubset.com>, debian-security@lists.debian.org
Subject: Re: CVE-2009-3555 not addressed in OpenSSL
From: Florian Weimer <fw@deneb.enyo.de>
Date: Thu, 21 Oct 2010 09:07:44 +0200
Message-id: <[🔎] 87bp6odnwf.fsf@mid.deneb.enyo.de>
In-reply-to: <87sk0z37qt.fsf@mocca.josefsson.org> (Simon Josefsson's message of "Fri, 24 Sep 2010 09:45:14 +0200")
References: <4C9B95A7.9080800@extendedsubset.com> <87sk0z37qt.fsf@mocca.josefsson.org>

* Simon Josefsson:

> FWIW, the latest stable GnuTLS version with RFC 5746 support is not
> even in testing, so it won't be part of even the next stable.

What would be required to get a backport of RFC 5746 support into the
current stable (considering that we do not want to incorporate too
many unrelated changes)?

Reply to:

Follow-Ups:
- Re: CVE-2009-3555 not addressed in OpenSSL
  - From: Simon Josefsson <simon@josefsson.org>

Prev by Date: Re: non-executable stack (via PT_GNU_STACK) not being enforced
Next by Date: Re: CVE-2009-3555 not addressed in OpenSSL
Previous by thread: RECEVEZ UN CHEQUE DE 180 € et 30 % d'économies sur vos dépenses de santé.
Next by thread: Re: CVE-2009-3555 not addressed in OpenSSL
Index(es):
- Date
- Thread