GnuTLS Certificate Verification


dohoriver

Still Fresh
Joined
Nov 20, 2013
Messages
1
With the recent discovery of a vulnerability in GnuTLS library regarding certificate verification, how is the Pandora affected, if at all?

http://gnutls.org/security.html

What about applications in the repository such as Pidgin, Claws Mail, etc. (applications I use on a daily basis). Do these applications need to be updated to be secure?
 
The all seeing eye doesn't need to wait for the email to reach your pandora ;)

but all seriously, there is likely something using it as a dependency but the following can be compiled with gnutls

aiccu

aria2

ario

bitlbee

claws-mail

connman

emacs

ffmpeg

filezilla

glib-networking

gloox

gnome-vfs

gnuplot

gnustep-base

gsasl

gst-plugins-bad

gtk-vnc

gwenhywfar

hefur

lftp

libimobiledevice

libinfinity

libmicrohttpd

libvirt

libvncserver

loudmouth

mailutils

minbif

net6

nullmailer

nzbget

openconnect

pianobar

pokerth

python2-gnutls

qemu

samba

smbclient

task

tigervnc

weechat

wireshark-cli

wput

xmlsec

rsyslog

wine

ghostscript

libcacard

libwbclient

qemu

rsyslog

samba

wine

wireshark.. so it's not a small list
 
But which of these actually rely on (strict) certificate validation? The ones using HTTPS requests, though a lot of these probably accept any certificate by default. Any other protocols where a similar trust model is used?
 
Back
Top