← Back to branch summary

~ubuntu-branches/ubuntu/saucy/gnutls26/saucy-security

« back to all changes in this revision

Viewing changes to lib/x509/verify.c

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2014-02-24 13:59:47 UTC
  • Revision ID: package-import@ubuntu.com-20140224135947-jfz7thda3wz9ugvg
Tags: 2.12.23-1ubuntu4.1
* SECURITY UPDATE: incorrect v1 intermediate cert handling
  - debian/patches/CVE-2014-1959.patch: don't consider a v1 intermediate
    cert to be a valid CA by default in lib/x509/verify.c.
  - CVE-2014-1959

Show diffs side-by-side

added added

removed removed

Lines of Context:
lib/x509/verify.c
644
644
      /* note that here we disable this V1 CA flag. So that no version 1
645
645
       * certificates can exist in a supplied chain.
646
646
       */
647
 
      if (!(flags & GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT))
 
647
      if (!(flags & GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT)) {
648
648
        flags &= ~(GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT);
 
649
        flags |= GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT;
 
650
      }
649
651
      if ((ret =
650
652
           _gnutls_verify_certificate2 (certificate_list[i - 1],
651
653
                                        &certificate_list[i], 1, flags,