Changeset 5513f3e for lib

Timestamp:

2011-12-24T14:52:35Z (12 years ago)

Author:

Wilmer van der Gaast <wilmer@…>

Branches:

master

Children:

96f954d

Parents:

200e151

Message:

Fix compatibility with old GnuTLS versions, but with a warning. See
​http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1417 for details.

File:

• lib/ssl_gnutls.c (modified) (2 diffs)

lib/ssl_gnutls.c

@@ -166 +166 @@
                 verifyret |= VERIFY_CERT_INSECURE_ALGORITHM;
 
+#ifdef GNUTLS_CERT_NOT_ACTIVATED
+        /* Amusingly, the GnuTLS function used above didn't check for expiry
+           until GnuTLS 2.8 or so. (See CVE-2009-1417) */
         if( status & GNUTLS_CERT_NOT_ACTIVATED )
                 verifyret |= VERIFY_CERT_NOT_ACTIVATED;
@@ -171 +174 @@
         if( status & GNUTLS_CERT_EXPIRED )
                 verifyret |= VERIFY_CERT_EXPIRED;
+#endif
 
         /* The following check is already performed inside