GNU bug report logs - #21227
24.5; tls connections not verified by default

Previous Next

Package: emacs;

Reported by: Glyph <glyph <at> twistedmatrix.com>

Date: Mon, 10 Aug 2015 02:32:01 UTC

Severity: important

Tags: fixed, security

Found in version 24.5

Fixed in version 25.1

Done: Lars Ingebrigtsen <larsi <at> gnus.org>

Bug is archived. No further changes may be made.

Full log

Message #14 received at 21227 <at> debbugs.gnu.org (full text, mbox):

From: Glenn Morris <rgm <at> gnu.org>
To: Glyph <glyph <at> twistedmatrix.com>
Cc: 21227 <at> debbugs.gnu.org
Subject: Re: bug#21227: 24.5; tls connections not verified by default
Date: Mon, 10 Aug 2015 11:53:44 -0400

Glyph wrote:

> have any security.  So Emacs should use a command-line which
> authoritatively makes connections correctly, linking against gnutls
> itself if necessary.

Emacs can be linked with Gnutls since Emacs 24.1. You have to compile it
that way though. I think this is perhaps part of the reason why a bunch
of bugs related to the old non-builtin TLS support are piling up. Eg
19283, 19284, 20078. IMO these issues really need to be addressed before
the next release.
This bug report was last modified 9 years and 148 days ago.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.