From owner-freebsd-bugs@FreeBSD.ORG  Sun Nov  8 00:30:08 2009
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 2DF751065670
	for <freebsd-bugs@hub.freebsd.org>;
	Sun,  8 Nov 2009 00:30:08 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org
	[IPv6:2001:4f8:fff6::28])
	by mx1.freebsd.org (Postfix) with ESMTP id 1D6A58FC1B
	for <freebsd-bugs@hub.freebsd.org>;
	Sun,  8 Nov 2009 00:30:08 +0000 (UTC)
Received: from freefall.freebsd.org (localhost [127.0.0.1])
	by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id nA80U7rC015810
	for <freebsd-bugs@freefall.freebsd.org>; Sun, 8 Nov 2009 00:30:08 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.14.3/8.14.3/Submit) id nA80U7cj015805;
	Sun, 8 Nov 2009 00:30:07 GMT (envelope-from gnats)
Date: Sun, 8 Nov 2009 00:30:07 GMT
Message-Id: <200911080030.nA80U7cj015805@freefall.freebsd.org>
To: freebsd-bugs@FreeBSD.org
From: Colin Percival <cperciva@freebsd.org>
Cc: 
Subject: Re: bin/140356: [patch] OpenSSL in base: fix CVE-2009-3555
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: Colin Percival <cperciva@freebsd.org>
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 08 Nov 2009 00:30:08 -0000

The following reply was made to PR bin/140356; it has been noted by GNATS.

From: Colin Percival <cperciva@freebsd.org>
To: bug-followup@FreeBSD.org, rea-fbsd@codelabs.ru
Cc: FreeBSD Security Team <secteam@freebsd.org>
Subject: Re: bin/140356: [patch] OpenSSL in base: fix CVE-2009-3555
Date: Sat, 07 Nov 2009 16:22:08 -0800

 Given that this is a rather obscure issue (not many people use client
 certificates) I'd like to wait until there is more consensus about how
 this should be fixed -- it may be that the conclusion will be that the
 approach taken by the OpenSSL team, of disabling renegotiation, is
 not the right solution.
 
 -- 
 Colin Percival
 Security Officer, FreeBSD | freebsd.org | The power to serve
 Founder / author, Tarsnap | tarsnap.com | Online backups for the truly paranoid