Bug 470054

Summary:	gentoo.org may benefit from SSL
Product:	Gentoo Infrastructure	Reporter:	Jason A. Donenfeld <zx2c4>
Component:	Other web server issues	Assignee:	Gentoo Infrastructure <infra-bugs>
Status:	RESOLVED FIXED
Severity:	major	CC:	phajdan.jr
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://gentoo.org
Whiteboard:
Package list:		Runtime testing required:	---
Bug Depends on:	482870
Bug Blocks:	469888

Description Jason A. Donenfeld gentoo-dev

2013-05-16 10:28:08 UTC

Various trusted assets are downloaded from gentoo.org, such as metadata.dtd, that are then passed to programs such as xmllint. Gentoo.org might benefit from having an SSL certificate to make such downloads more secure.

Reproducible: Always

Comment 1 Jason A. Donenfeld gentoo-dev

2013-05-16 10:30:25 UTC

This has been assigned CVE-2013-2100.

Comment 2 Jason A. Donenfeld gentoo-dev

2013-05-17 21:43:00 UTC

This also affects Layman.

http://www.gentoo.org/proj/en/overlays/repositories.xml

Comment 3 Robin Johnson archtester

2013-08-29 02:49:54 UTC

www.gentoo.org has an SSL cert from DigiCert. You MUST support SNI.