4 ms·
>The bug is a use-after-free triggered when a TLS connection is handled by GnuTLS Color me surprised. The GNU ecosystem has had more than its fair share of CV
by stackghost 5mo ago
>The bug is a use-after-free triggered when a TLS connection is handled by GnuTLS
Color me surprised. The GNU ecosystem has had more than its fair share of CVEs over the years to the point that it's now a common trope:
https://soatok.blog/2020/07/08/gnu-a-heuristic-for-bad-cryptography/ https://soatok.blog/2020/07/08/gnu-a-heuristic-for-bad-crypt...
- chadgpt1 5mo agoIf you read the rest of the post, gnutls wasn't the cause.
- yrro 5mo agoDebian builds Exim against GnuTLS because OpenSSL used to use a license with an advertising clause, making it incompatible with the GPLd Exim. Since OpenSSL 3 is now available under a GPL-compatible license, I think it's long past time to switch. But judging by the sorry state of https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=446036 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=446036 I don't think it's going to happen any time soon.