News for hackers. Stuff that matters.

A comment on Critical crypto bug leaves Linux, hundreds of apps open to eavesdropping. Parent comment

Re: Critical crypto bug leaves Linux, hundreds of apps open ... by masklinn on Tuesday March 04, 2014 @03:40PM (#7342945)
> My guess is that it's also been embedded in GnuTLS for longer than the SecureTransport bug had been.

One of Ars's commenters linked to http://www.openldap.org/lists/openldap-devel/200802/msg00072...

edit: acc00 provided a link to the commit introducing the bug: https://www.gitorious.org/gnutls/gnutls/commit/0fba2d908da6d...

it's a bit more than 10 years old.

[ Parent | on HN ]
Re: Critical crypto bug leaves Linux, hundreds of apps open ... by rquirk on Wednesday March 05, 2014 @02:37AM (#7345853)
Was the commit that added the problem not this one? It adds the issuer_version and returns it as the value for the check instead of returning 0.

https://www.gitorious.org/gnutls/gnutls/commit/12f135e099a57...

That was 2003-03-03, 11 years almost to the day.

[ Parent | on HN ]