GnuTLS Certificate Verification

[dohoriver]

With the recent discovery of a vulnerability in GnuTLS library regarding certificate verification, how is the Pandora affected, if at all?

http://gnutls.org/security.html

What about applications in the repository such as Pidgin, Claws Mail, etc. (applications I use on a daily basis). Do these applications need to be updated to be secure?

 

[ShleeDragon]

The all seeing eye doesn't need to wait for the email to reach your pandora

but all seriously, there is likely something using it as a dependency but the following can be compiled with gnutls

aiccu

aria2

ario

bitlbee

claws-mail

connman

emacs

ffmpeg

filezilla

glib-networking

gloox

gnome-vfs

gnuplot

gnustep-base

gsasl

gst-plugins-bad

gtk-vnc

gwenhywfar

hefur

lftp

libimobiledevice

libinfinity

libmicrohttpd

libvirt

libvncserver

loudmouth

mailutils

minbif

net6

nullmailer

nzbget

openconnect

pianobar

pokerth

python2-gnutls

qemu

samba

smbclient

task

tigervnc

weechat

wireshark-cli

wput

xmlsec

rsyslog

wine

ghostscript

libcacard

libwbclient

qemu

rsyslog

samba

wine

wireshark.. so it's not a small list

 

[_jr_]

But which of these actually rely on (strict) certificate validation? The ones using HTTPS requests, though a lot of these probably accept any certificate by default. Any other protocols where a similar trust model is used?