Matthias Bläsing
2008-Nov-25 20:28 UTC
[Secure-testing-team] Bug#506906: [evolution] evolutions ssl certificate warnings are less than usefull
Package: evolution
Version: 2.22.3.1-1
Severity: normal
Tags: security
X-Debbugs-CC: secure-testing-team at lists.alioth.debian.org
--- Please enter the report below this line. ---
Hey,
I was confronted with evoltions ssl certificate check. It just took me
almost half an hour to realise, that the host name didn''t match - great
why didn''t evolution tell me this?
At least I would have expected a real error message and not just the
presentation of the basic infos of the offending certificate.
Even better: Display the certificat info in a meaningful way, state the
error and allow the user to accept the certificate.
Thanks in advance
Matthias
PS: I declared this a security bug, because the current behaviour is
just useless and make the user react lax to security warnings.
--- System information. ---
Architecture: i386
Kernel: Linux 2.6.28-rc6
Debian Release: lenny/sid
500 unstable www.debian-multimedia.org
500 unstable ftp.de.debian.org
500 testing ftp.de.debian.org
1 experimental ftp.de.debian.org
--- Package information. ---
Depends (Version) | Installed
==============================================-+-=================libart-2.0-2
(>= 2.3.18) | 2.3.20-2
libatk1.0-0 (>= 1.20.0) | 1.24.0-1
libbluetooth2 (>= 3.14) | 3.36-1
libbonobo2-0 (>= 2.15.0) | 2.24.0-1
libbonoboui2-0 (>= 2.15.1) | 2.24.0-1
libc6 (>= 2.7-1) | 2.8+20080809-1
libcairo2 (>= 1.2.4) | 1.8.4-1
libcamel1.2-11 (>= 2.22.2) | 2.22.3-1.1
libdbus-1-3 (>= 1.0.2) | 1.2.1-4
libdbus-glib-1-2 (>= 0.71) | 0.76-1
libebook1.2-9 (>= 2.22.2) | 2.22.3-1.1
libecal1.2-7 (>= 2.22.2) | 2.22.3-1.1
libedataserver1.2-9 (>= 2.22.2) | 2.22.3-1.1
libedataserverui1.2-8 (>= 2.22.2) | 2.22.3-1.1
libegroupwise1.2-13 (>= 2.22.2) | 2.22.3-1.1
libexchange-storage1.2-3 (>= 2.22.2) | 2.22.3-1.1
libfontconfig1 (>= 2.4.0) | 2.6.0-3
libfreetype6 (>= 2.3.5) | 2.3.7-2
libgconf2-4 (>= 2.13.5) | 2.24.0-2
libglade2-0 (>= 1:2.6.1) | 1:2.6.3-1
libglib2.0-0 (>= 2.16.0) | 2.18.3-1
libgnome-pilot2 (>= 2.0.2) | 2.0.15-2.4
libgnome2-0 (>= 2.17.3) | 2.24.1-1
libgnomecanvas2-0 (>= 2.11.1) | 2.20.1.1-1
libgnomeui-0 (>= 2.17.1) | 2.22.1-1
libgnomevfs2-0 (>= 1:2.17.90) | 1:2.24.0-1
libgtk2.0-0 (>= 2.12.0) | 2.14.4-3
libgtkhtml3.14-19 (>= 3.18.3) | 3.18.3-1
libhal1 (>= 0.5.8.1) | 0.5.11-6
libice6 (>= 1:1.0.0) | 2:1.0.4-1
libldap-2.4-2 (>= 2.4.7) | 2.4.11-1
libnm-glib0 | 0.7.0~svn4191-1
libnotify1 (>= 0.4.4) | 0.4.4-3
libnotify1-gtk2.10 |
libnspr4-0d (>= 1.8.0.10) | 4.7.1-4
libnss3-1d (>= 3.12.0~1.9b1) | 3.12.0-5
liborbit2 (>= 1:2.14.10) | 1:2.14.16-0.1
libpango1.0-0 (>= 1.20.3) | 1.22.3-1
libpisock9 | 0.12.3-5
libpisync1 | 0.12.3-5
libpixman-1-0 | 0.12.0-1
libpng12-0 (>= 1.2.13-4) | 1.2.33-1
libpopt0 (>= 1.14) | 1.14-4
libsm6 | 2:1.1.0-1
libsoup2.4-1 (>= 2.4.1) | 2.24.1-1
libusb-0.1-4 (>= 2:0.1.12) | 2:0.1.12-13
libx11-6 | 2:1.1.5-2
libxcb-render-util0 | 0.3.1-2
libxcb-render0 | 1.1-1.1
libxcb1 | 1.1-1.1
libxcursor1 (>> 1.1.2) | 1:1.1.9-1
libxext6 | 2:1.0.4-1
libxfixes3 (>= 1:4.0.1) | 1:4.0.3-2
libxi6 | 2:1.1.4-1
libxinerama1 | 2:1.0.3-2
libxml2 (>= 2.6.27) | 2.6.32.dfsg-5
libxrandr2 | 2:1.2.3-1
libxrender1 | 1:0.9.4-2
zlib1g (>= 1:1.1.4) | 1:1.2.3.3.dfsg-12
gconf2 (>= 2.10.1-2) | 2.24.0-2
evolution-common (= 2.22.3.1-1) | 2.22.3.1-1
evolution-data-server (>= 2.21.92) | 2.22.3-1.1
evolution-data-server (<< 2.23.0) | 2.22.3-1.1
gtkhtml3.14 (>= 3.17.5) | 3.18.3-1
gnome-icon-theme (>= 2.19.91) | 2.22.0-1
dbus | 1.2.1-4
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Dies ist ein digital signierter Nachrichtenteil
Url :
http://lists.alioth.debian.org/pipermail/secure-testing-team/attachments/20081125/d37216e8/attachment.pgp