Re: bug in SSL certificate validation
Axel Beckert <[email protected]>
| Newsgroups | gmane.comp.web.lynx.devel |
|---|---|
| Organization | DeuxChevaux.org -- The Citr oën 2CV Database |
| Message-ID | <[email protected]> |
Hi, On Fri, Aug 06, 2021 at 05:14:32PM +0000, Thorsten Glaser wrote: > this affects both OpenSSL and Debian’s nonGNUtls builds: > > lynx https://user:pass@host/ > > … will lead to… […] > SSL error:host(user:pass@host)!=cert(CN<mainhost>)-Continue? (n) > > … for nonGNUtls lynx. Indeed. https://user@host/ as well, btw. > Obviously, user:pass@ need to be stripped before comparing. I would be happy if there'd be a separate patch for this so we can potentially backport this to already released versions of Lynx. I was able to reproduce this issue in Lynx in all currently (in some way) supported releases of Debian back to Debian 8 Jessie with ELTS support which has Lynx 2.8.9dev1. Kind regards, Axel -- PGP: 2FF9CD59612616B5 /~\ Plain Text Ribbon Campaign, http://arc.pasp.de/ Mail: [email protected] \ / Say No to HTML in E-Mail and Usenet Mail+Jabber: [email protected] X https://axel.beckert.ch/ / \ I love long mails: https://email.is-not-s.ms/ _______________________________________________ Lynx-dev mailing list [email protected] https://lists.nongnu.org/mailman/listinfo/lynx-dev