Re: Pidgin does not validate correctly certificate chain

--===============0777841128935313771==
Content-Type: multipart/alternative; boundary="000000000000cf4876058d485d70"

--000000000000cf4876058d485d70
Content-Type: text/plain; charset="UTF-8"

Hi Luiz,

(looping in devel and security mailing lists)
Apologies for there not being any follow-up to your ticket.  We are just a
bunch of volunteers who work on Pidgin in our spare time, so promptness
isn't always guaranteed.

To help with your ticket, do you have an example server that we can test
against?  a) to test if things are broken using NSS instead of gnutls and
b) to verify any potential fixes?  It's probably safe to say that the setup
you've got isn't the majority of SSL use-cases and I doubt that any of us
who work on Pidgin would have certs in a similar setup.

I see that you've also had a look through how the code works for the gnutls
verification.  Have you had a chance to try fixing the issue yourself?  If
so, are there any patches or PR's that you might be interested in supplying
to help speed things along?

Cheers,
Eion




On Wed, 10 Jul 2019 at 05:44, Luiz Angelo Daros de Luca <[email protected]>
wrote:

> Hello,
>
> I've opened a bug report regard this issue.
>
> https://developer.pidgin.im/ticket/17393
>
> But there is no feedback for it. It could even be classified as a security
> bug as
> pidgin/libpurple is not validating certificates correctly, resulting in
> name constraints errors (both validating where it should not and not
> checking it when it should).
>
> Regards,
> ---
>      Luiz Angelo Daros de Luca
>             [email protected]
> _______________________________________________
> [email protected] mailing list
> Want to unsubscribe?  Use this link:
> https://lists.pidgin.im/listinfo/support

--000000000000cf4876058d485d70
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Luiz,<div><br></div><div>(looping in devel and security=
 mailing lists)</div><div>Apologies for there not being any follow-up to yo=
ur ticket.=C2=A0 We are just a bunch of volunteers who work on Pidgin in ou=
r spare time, so promptness isn&#39;t always guaranteed.</div><div><br></di=
v><div>To help with your ticket, do you have an example server that we can =
test against?=C2=A0 a) to test if things are broken using NSS instead of gn=
utls and b) to verify any potential fixes?=C2=A0 It&#39;s probably safe to =
say that the setup you&#39;ve got isn&#39;t the majority of SSL use-cases a=
nd I doubt that any of us who work on Pidgin would have certs in a similar =
setup.</div><div><br></div><div>I see that you&#39;ve also had a look throu=
gh how the code works for the gnutls verification.=C2=A0 Have you had a cha=
nce to try fixing the issue yourself?=C2=A0 If so, are there any patches or=
 PR&#39;s that you might be interested in supplying to help speed things al=
ong?=C2=A0</div><div><br></div><div>Cheers,</div><div>Eion</div><div><br></=
div><div><br></div><div><br></div></div><br><div class=3D"gmail_quote"><div=
 dir=3D"ltr" class=3D"gmail_attr">On Wed, 10 Jul 2019 at 05:44, Luiz Angelo=
 Daros de Luca &lt;<a href=3D"mailto:[email protected]">[email protected]=
</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:=
0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">=
<div dir=3D"ltr"><div>Hello,</div><div><br></div><div>I&#39;ve opened a bug=
 report regard this issue.</div><div><br></div><a href=3D"https://developer=
.pidgin.im/ticket/17393" target=3D"_blank">https://developer.pidgin.im/tick=
et/17393</a><div><br></div><div><div>But there is no feedback for it. It co=
uld even be classified as a security bug as<br></div><div>pidgin/libpurple =
is not validating certificates correctly, resulting in name constraints err=
ors (both validating where it should not and not checking it when it should=
).</div><div><br></div><div>Regards,</div><div><div><div dir=3D"ltr" class=
=3D"gmail-m_8179542814890923805gmail_signature"><div dir=3D"ltr"><div>---<b=
r>=C2=A0 =C2=A0=C2=A0 Luiz Angelo Daros de Luca<br>=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 <a href=3D"mailto:[email protected]" target=3D"_blank">l=
[email protected]</a></div></div></div></div></div></div></div>
_______________________________________________<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a=
> mailing list<br>
Want to unsubscribe?=C2=A0 Use this link:<br>
<a href=3D"https://lists.pidgin.im/listinfo/support" rel=3D"noreferrer" tar=
get=3D"_blank">https://lists.pidgin.im/listinfo/support</a></blockquote></d=
iv>

--000000000000cf4876058d485d70--


--===============0777841128935313771==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KRGV2ZWwgbWFp
bGluZyBsaXN0CkRldmVsQHBpZGdpbi5pbQpodHRwczovL2xpc3RzLnBpZGdpbi5pbS9saXN0aW5m
by9kZXZlbA==

--===============0777841128935313771==--