470054 – gentoo.org may benefit from SSL

Bug 470054 - gentoo.org may benefit from SSL

Summary: gentoo.org may benefit from SSL

Status:	RESOLVED FIXED

Alias:	None

Product:	Gentoo Infrastructure
Classification:	Unclassified
Component:	Other web server issues (show other bugs)
Hardware:	All Linux

Importance:	Normal major (vote)
Assignee:	Gentoo Infrastructure

URL:	https://gentoo.org
Whiteboard:
Keywords:

Depends on:	482870
Blocks:	CVE-2013-2100
	Show dependency tree

Reported:	2013-05-16 10:28 UTC by Jason A. Donenfeld
Modified:	2013-08-29 02:49 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Jason A. Donenfeld gentoo-dev

2013-05-16 10:28:08 UTC

Various trusted assets are downloaded from gentoo.org, such as metadata.dtd, that are then passed to programs such as xmllint. Gentoo.org might benefit from having an SSL certificate to make such downloads more secure.

Reproducible: Always

Comment 1 Jason A. Donenfeld gentoo-dev

2013-05-16 10:30:25 UTC

This has been assigned CVE-2013-2100.

Comment 2 Jason A. Donenfeld gentoo-dev

2013-05-17 21:43:00 UTC

This also affects Layman.

http://www.gentoo.org/proj/en/overlays/repositories.xml

Comment 3 Robin Johnson archtester

2013-08-29 02:49:54 UTC

www.gentoo.org has an SSL cert from DigiCert. You MUST support SNI.