diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2013-11-29 22:46:05 +0100 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2013-12-16 22:47:31 +0100 |
| commit | 1dc43de0dccc2ea7da6dddb7b98f8d7dcf323914 (patch) | |
| tree | 39a854a8cc010acc3ba917c865b071a3e0a78b50 | |
| parent | 8a8f9a5d5775ea58807b3c3ff86a9b96ae4b0925 (diff) | |
| download | curl-1dc43de0dccc2ea7da6dddb7b98f8d7dcf323914.tar.gz | |
gtls: respect *VERIFYHOST independently of *VERIFYPEER
Security flaw CVE-2013-6422
This is conceptually the same problem and fix that 3c3622b6 brought to the
OpenSSL backend and that resulted in CVE-2013-4545.
This version of the problem was independently introduced to the GnuTLS
backend with commit 59cf93cc, present in the code since the libcurl
7.21.4 release.
Advisory: http://curl.haxx.se/docs/adv_20131217.html
Bug: http://curl.haxx.se/mail/lib-2013-11/0214.html
Reported-by: Marc Deslauriers
| -rw-r--r-- | lib/gtls.c | 8 |
1 files changed, 2 insertions, 6 deletions
diff --git a/lib/gtls.c b/lib/gtls.c index 700e46a9d..b64dfa61c 100644 --- a/lib/gtls.c +++ b/lib/gtls.c @@ -5,7 +5,7 @@ * | (__| |_| | _ <| |___ * \___|\___/|_| \_\_____| * - * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al. + * Copyright (C) 1998 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al. * * This software is licensed as described in the file COPYING, which * you should have received as part of this distribution. The terms @@ -633,10 +633,8 @@ gtls_connect_step3(struct connectdata *conn, else infof(data, "\t server certificate verification OK\n"); } - else { + else infof(data, "\t server certificate verification SKIPPED\n"); - goto after_server_cert_verification; - } /* initialize an X.509 certificate structure. */ gnutls_x509_crt_init(&x509_cert); @@ -766,8 +764,6 @@ gtls_connect_step3(struct connectdata *conn, gnutls_x509_crt_deinit(x509_cert); -after_server_cert_verification: - /* compression algorithm (if any) */ ptr = gnutls_compression_get_name(gnutls_compression_get(session)); /* the *_get_name() says "NULL" if GNUTLS_COMP_NULL is returned */ |