there is an interesting and serious security vulnerability in OpenSSL that may impact Gemini servers. basically a Malformed certificate can cause a crash to a program using OpenSSL to read it. Gemini uses client side certificates, so I can create a malformed client side and connect to random Gemini capsides and send it as part of the TLS handshake. this could crash the Gemini server.
to be clear I think TLS in Gemini is A Good Thing (tm). this is the biggest issue in 6 years which shows how far OpenSSL has come. but it does show how the security of a system is a union of the security of its parts
https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/
6 months ago 路 馃憤 eaplmx, prk, oofbar, tm85
[1] https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/
Score 1 for those of use not using OpenSSL 路 6 months ago
Yet another reason to host capsules on ESP32 with mbedtls 路 6 months ago
ahhh. looks like a self-signed cert, which virtually all client-side certs used in Gemini clients are, will not activate the vulnerable code path.
https://github.com/colmmacc/CVE-2022-3602 路 6 months ago
Wow, thanks for sharing. I also thing that TLS is good for privacy reasons, so I guess it's a good moment to update OpenSSL... 馃 路 6 months ago