News for hackers. Stuff that matters.

A comment on GnuTLS certificate verification vulnerability announced (CVE-2014-0092). Parent comment

Re:GnuTLS certificate verification vulnerability announced (... by dekkers on Tuesday March 04, 2014 @06:00AM (#7339523)
Distributions can't take advantage of the system libraries exception, it only works for software that isn't shipped together with OpenSSL. The whole GPLv2 clause:

"However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable."

[ Parent | on HN ]
Re:GnuTLS certificate verification vulnerability announced (... by nknighthb on Tuesday March 04, 2014 @06:52AM (#7339673)
That is one reasonable interpretation of "accompanies", but it is not the only one. Hence the existence of debate. (Consider, for example, a CDN that happens to distribute both a Linux distribution that includes OpenSSL, and an unrelated GPL project not included in the distribution and written by people who don't contribute to the distribution. You surely would not believe this meets the definition of "accompanies" as used in the GPL? Now, figure out where the line is crossed.)
[ Parent | on HN ]