Bug 857483

Summary:	Apply patch to enable ssmtp to check server certificates when using TLS
Product:	[Fedora] Fedora	Reporter:	Vincent Danen <vdanen>
Component:	ssmtp	Assignee:	manuel wolfshant <manuel.wolfshant>
Status:	CLOSED DUPLICATE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	high
Version:	18	CC:	jlieskov, manuel.wolfshant
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-10-11 15:47:11 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Vincent Danen 2012-09-14 14:50:22 UTC

A Debian bug was filed about ssmtp not checking certificates:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=662960

And it includes a patch to enable checking of server certificates when using TLS:

http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=0003-Validate-the-server-certificate-when-using-TLS.patch;att=1;bug=662960

We should include this patch.

Note that this isn't a security _flaw_ because the TLS file in the source tarball clearly states that this feature is missing:


TODO:
* Check server certificate for changes and notify about it.
* Diffrent Certificate and Key file?


This patch would be ideal to have in both Fedora and EPEL ssmtp packages.

Comment 1 manuel wolfshant 2012-10-10 11:01:11 UTC

*** Bug 864894 has been marked as a duplicate of this bug. ***

Comment 2 Vincent Danen 2012-10-11 15:47:11 UTC

Please refer to the SRT bug for this (one of these is a dupe, but using this as the dupe rather than the SRT/CVE bug).

*** This bug has been marked as a duplicate of bug 864894 ***