Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 765796 (CVE-2020-35733)

Summary: <dev-lang/erlang-23.2.2: Invalid TLS certificate validation (CVE-2020-35733)
Product: Gentoo Security Reporter: Sam James <sam>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: IN_PROGRESS ---    
Severity: minor CC: jpds, matthew
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://erlang.org/pipermail/erlang-questions/2021-January/100357.html
Whiteboard: B4 [glsa cve]
Package list:
Runtime testing required: ---
Bug Depends on: 755236    
Bug Blocks: 749345    

Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-01-17 19:53:23 UTC
Description:
"An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an invalid X.509 certificate chain to a trusted root Certification Authority."
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-01-17 19:53:53 UTC
Please tell us when ready to stable, expedited if possible.
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-01-28 03:01:41 UTC
ping?
Comment 3 John Helmert III gentoo-dev Security 2021-02-06 16:43:29 UTC
Erlang 23.2.1 isn't sufficient to fix this bug.
Comment 4 NATTkA bot gentoo-dev 2021-03-06 10:16:56 UTC Comment hidden (obsolete)
Comment 5 John Helmert III gentoo-dev Security 2021-03-06 14:57:18 UTC
Stabilization was done in bug 773016. Please cleanup.
Comment 6 John Helmert III gentoo-dev Security 2021-03-13 16:14:24 UTC
Ping. Please cleanup.
Comment 7 Larry the Git Cow gentoo-dev 2021-04-28 18:16:28 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f06f1d7a8d16f0c9730128c56f2a8e22e88b42a3

commit f06f1d7a8d16f0c9730128c56f2a8e22e88b42a3
Author:     Sergei Trofimovich <slyfox@gentoo.org>
AuthorDate: 2021-04-28 18:16:02 +0000
Commit:     Sergei Trofimovich <slyfox@gentoo.org>
CommitDate: 2021-04-28 18:16:23 +0000

    dev-lang/erlang: drop old
    
    Bug: https://bugs.gentoo.org/749345
    Bug: https://bugs.gentoo.org/765796
    Package-Manager: Portage-3.0.18, Repoman-3.0.3
    Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>

 dev-lang/erlang/Manifest             |   3 -
 dev-lang/erlang/erlang-23.0.4.ebuild | 158 -----------------------------------
 2 files changed, 161 deletions(-)
Comment 8 John Helmert III gentoo-dev Security 2021-07-25 02:12:57 UTC
GLSA request filed.
Comment 9 NATTkA bot gentoo-dev 2021-07-29 17:24:28 UTC Comment hidden (obsolete)
Comment 10 NATTkA bot gentoo-dev 2021-07-29 17:32:58 UTC Comment hidden (obsolete)
Comment 11 NATTkA bot gentoo-dev 2021-07-29 17:40:49 UTC Comment hidden (obsolete)
Comment 12 NATTkA bot gentoo-dev 2021-07-29 17:48:59 UTC Comment hidden (obsolete)
Comment 13 NATTkA bot gentoo-dev 2021-07-29 18:04:55 UTC Comment hidden (obsolete)
Comment 14 NATTkA bot gentoo-dev 2021-07-29 18:13:13 UTC
Package list is empty or all packages have requested keywords.
Comment 15 Matthew Smith gentoo-dev 2022-03-12 08:09:54 UTC
Affected versions no longer in tree.