Bug#514807: Regression in libgnutls security update
fw at deneb.enyo.de
Wed Feb 11 23:05:31 UTC 2009
* Simon Josefsson:
> What can be done here is to produce better documentation, perhaps in
> release notes. People must be aware that trusting X.509 certificate
> chains containing RSA-MD5 signatures or V1 CAs is insecure.
I think it is somewhat debatable if this also applies to the root CA
container, where the X.509 structure is just use as a transport for
key material. The RSA-MD5 signature does not hurt there, and the DN
doesn't really matter, either. The risk I see is that someone adds a
v1 *server* certificate to the trusted list, without realizing that it
will act as a *CA* certificate in this place.
More information about the Pkg-gnutls-maint