*** This bug is a security vulnerability *** Public security bug reported:
http://www.openwall.com/lists/oss-security/2015/01/29/23 XChat did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name. Also applied to hexchat and xchat-gnome. ** Affects: hexchat (Ubuntu) Importance: Undecided Status: New ** Affects: xchat (Ubuntu) Importance: Undecided Status: Invalid ** Affects: xchat-gnome (Ubuntu) Importance: Undecided Status: New ** Affects: hexchat (Ubuntu Precise) Importance: Undecided Status: New ** Affects: xchat (Ubuntu Precise) Importance: Undecided Status: New ** Affects: xchat-gnome (Ubuntu Precise) Importance: Undecided Assignee: Marc Deslauriers (mdeslaur) Status: Confirmed ** Affects: hexchat (Ubuntu Trusty) Importance: Undecided Status: New ** Affects: xchat (Ubuntu Trusty) Importance: Undecided Status: New ** Affects: xchat-gnome (Ubuntu Trusty) Importance: Undecided Status: New ** Affects: hexchat (Ubuntu Wily) Importance: Undecided Status: New ** Affects: xchat (Ubuntu Wily) Importance: Undecided Status: New ** Affects: xchat-gnome (Ubuntu Wily) Importance: Undecided Status: New ** Affects: hexchat (Ubuntu Xenial) Importance: Undecided Status: New ** Affects: xchat (Ubuntu Xenial) Importance: Undecided Status: Invalid ** Affects: xchat-gnome (Ubuntu Xenial) Importance: Undecided Status: New ** Also affects: xchat (Ubuntu) Importance: Undecided Status: New ** Also affects: hexchat (Ubuntu) Importance: Undecided Status: New ** Bug watch added: Red Hat Bugzilla #1081839 https://bugzilla.redhat.com/show_bug.cgi?id=1081839 -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to xchat-gnome in Ubuntu. https://bugs.launchpad.net/bugs/1565000 Title: xchat-gnome doesn't validate ssl hostnames To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/hexchat/+bug/1565000/+subscriptions -- desktop-bugs mailing list desktop-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/desktop-bugs
