[Bug 1380231] Re: Potential Vulnerability for X509 Certificate Verification

2014-10-13 Thread Jan Wagner
** Information type changed from Public Security to Public -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nagios-plugins in Ubuntu. https://bugs.launchpad.net/bugs/1380231 Title: Potential Vulnerability for X509 Certificate

[Bug 1380231] Re: Potential Vulnerability for X509 Certificate Verification

2014-10-13 Thread Jan Wagner
Right from the plugins documentation (--help) of the plugins: Please note that this plugin does not check if the presented server certificate matches the hostname of the server, or if the certificate has a valid chain of trust to one of the locally installed CAs. The question now is, how do

[Bug 1380231] Re: Potential Vulnerability for X509 Certificate Verification

2014-10-13 Thread Jerry Zhang
Thanks for your reply. Sorry, I don't think that we can reach this conclusion from the analysis. I've deleted that in the report now. This happens because we are using a template to report this kind of problems. But about checking the hostname, are you going to act on it or you have a reason for

[Bug 1380231] Re: Potential Vulnerability for X509 Certificate Verification

2014-10-13 Thread Jan Wagner
Upstream is accepting PullRequest for such features to implement that in general for all those ssl/tls capable checks as an option. More details about contributing can be found at: https://www.monitoring-plugins.org/development.html -- You received this bug notification because you are a