<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style='--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'>
<div class="content">
<p class="details" style="font-style: italic; color: #626168;">
<a href="https://gitlab.com/Jennifer-first">Jennifer-first</a> created an issue: <a href="https://gitlab.com/gnutls/gnutls/-/issues/1711">#1711</a>
</p>
<div class="md" style="position: relative; z-index: 1; color: #3a383f; word-wrap: break-word;">
<h2 dir="auto" style="margin-top: 0; margin-bottom: 10px;" align="initial">
<a href="#description-of-problem" aria-hidden="true" class="anchor" id="user-content-description-of-problem" style="margin-top: 0; margin-left: -20px; text-decoration: none; outline: none; position: absolute; width: 20px;"></a>Description of problem:</h2>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">During testing of GnuTLS certificate verification, we observed that gnutls-cli accepts a server certificate whose Common Name (CN) does not match the hostname of the server it connects to (localhost). This may allow a Man-in-the-Middle (MitM) attack if hostname verification is improperly implemented or omitted.<a href="https://gitlab.com/-/project/179611/uploads/932d7a897a12f310fb2e45e8be4d59f0/deepseek.py" data-canonical-src="/uploads/932d7a897a12f310fb2e45e8be4d59f0/deepseek.py" data-link="true" class="gfm" style="margin-top: 0;">deepseek.py</a></p>
<h2 dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">
<a href="#version-of-gnutls-used" aria-hidden="true" class="anchor" id="user-content-version-of-gnutls-used" style="margin-top: 0; margin-left: -20px; text-decoration: none; outline: none; position: absolute; width: 20px;"></a>Version of gnutls used:</h2>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">gnutls 3.7.3</p>
<h2 dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">
<a href="#distributor-of-gnutls-eg-ubuntu-fedora-rhel" aria-hidden="true" class="anchor" id="user-content-distributor-of-gnutls-eg-ubuntu-fedora-rhel" style="margin-top: 0; margin-left: -20px; text-decoration: none; outline: none; position: absolute; width: 20px;"></a>Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)</h2>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">Ubuntu</p>
<h2 dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">
<a href="#how-reproducible" aria-hidden="true" class="anchor" id="user-content-how-reproducible" style="margin-top: 0; margin-left: -20px; text-decoration: none; outline: none; position: absolute; width: 20px;"></a>How reproducible:</h2>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">Steps to Reproduce:</p>
<ul dir="auto" style="text-align: initial; list-style-type: disc; margin: 0 0 1rem; padding: 0;">
<li style="margin-top: 0; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">one:python3 deepseek.py</li>
</ul>
<h2 dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">
<a href="#actual-results" aria-hidden="true" class="anchor" id="user-content-actual-results" style="margin-top: 0; margin-left: -20px; text-decoration: none; outline: none; position: absolute; width: 20px;"></a>Actual results:</h2>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">The connection succeeds and the certificate is accepted, even though the Common Name does not match the hostname. This behavior may indicate that hostname verification is either missing or not enabled by default.
<a class="no-attachment-icon gfm" href="https://gitlab.com/-/project/179611/uploads/f0bc9d81c4a82db00bc1d51846424854/image.png" target="_blank" rel="noopener noreferrer" data-canonical-src="/uploads/f0bc9d81c4a82db00bc1d51846424854/image.png" data-link="true" style="margin-top: 0;"><img src="https://gitlab.com/-/project/179611/uploads/f0bc9d81c4a82db00bc1d51846424854/image.png" alt="image" data-canonical-src="/uploads/f0bc9d81c4a82db00bc1d51846424854/image.png" class="gfm" style="max-width: 100%; height: auto; margin-top: 0; vertical-align: baseline;"></a></p>
<h2 dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">
<a href="#expected-results" aria-hidden="true" class="anchor" id="user-content-expected-results" style="margin-top: 0; margin-left: -20px; text-decoration: none; outline: none; position: absolute; width: 20px;"></a>Expected results:</h2>
<p dir="auto" style="color: #3a383f; margin: 0;" align="initial">GnuTLS should reject the certificate because the CN in the server certificate (WrongServer) does not match the target hostname (localhost).</p>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #626168;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/issues/1711">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.com">gitlab.com</a>. <a href="https://gitlab.com/-/sent_notifications/0bd7c929d7066774a714afbc668baa63/unsubscribe" target="_blank" rel="noopener noreferrer">Unsubscribe</a> from this thread · <a href="https://gitlab.com/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://gitlab.com/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
<span style="color: transparent; font-size: 0; display: none; overflow: hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">
Notification message regarding https://gitlab.com/gnutls/gnutls/-/issues/1711 at 1747286271
</span>
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/-/issues/1711"}}</script>
</p>
</div>
</body>
</html>