> My guess is that it's also been embedded in GnuTLS for longer than the SecureT... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

masklinn on March 4, 2014 | parent | context | favorite | on: Critical crypto bug leaves Linux, hundreds of app...

> My guess is that it's also been embedded in GnuTLS for longer than the SecureTransport bug had been.

One of Ars's commenters linked to http://www.openldap.org/lists/openldap-devel/200802/msg00072...

edit: acc00 provided a link to the commit introducing the bug: https://www.gitorious.org/gnutls/gnutls/commit/0fba2d908da6d...

it's a bit more than 10 years old.

rquirk on March 5, 2014 [–]

Was the commit that added the problem not this one? It adds the issuer_version and returns it as the value for the check instead of returning 0.

https://www.gitorious.org/gnutls/gnutls/commit/12f135e099a57...

That was 2003-03-03, 11 years almost to the day.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact