Hi friends,

I'm especially forwarding this from the tracker to get some more eyeballs on
this issue:

https://sourceforge.net/tracker/?func=detail&atid=100976&aid=2829955&group_id=976

   "There's a new wildcard cert attack made public here:
   http://www.theregister.co.uk/2009/07/30/universal_ssl_certificate/

   I took a pass over the name matching code, and unless something in openssl
   or the code that gets at the subject names is somehow immune, the matching
   logic seems to be vulnerable. If not, feel free to close."

I'll get on on the case soon as well, but feel encouraged to join in and help!
Received on 2009-07-31