Bug#696681: falconpl: possible security issue due to misuse of the libcurl API

2012-12-25 Thread Alessandro Ghedini
Package: falconpl Severity: serious Tags: security Hi, I recently discovered that falconpl is using the libcurl API in a way that may not be what the original author intended. In particular I'm referring to the fact that the CURLOPT_SSL_VERIFYHOST option is treated as it was a boolean value

Bug#696681: falconpl: possible security issue due to misuse of the libcurl API

2012-12-25 Thread Kartik Mistry
On Tue, Dec 25, 2012 at 11:11 PM, Alessandro Ghedini gh...@debian.org wrote: After discussing this with the security team, it was decided that it would be best if this was fixed before the Wheezy release. Note that this should be fixed anyway, since as of curl v7.28.1 (which has been

Bug#696681: falconpl: possible security issue due to misuse of the libcurl API

2012-12-25 Thread Vasudev Kamath
On Wed, Dec 26, 2012 at 11:16 AM, Kartik Mistry kartik.mis...@gmail.com wrote: This is done already: https://groups.google.com/forum/?fromgroups=#!msg/falconpl/Vnnv0yb-_Bg/Vkl5RFHEk8QJ (and related discussions on IRC at #falconpl, Freenode) Just a note patch is already merged into upstream [1]