Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1049986 > unrolled thread

Bug#983589: w3m: Cannot verify certificates any more

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#983589: w3m: Cannot verify certificates any more Samuel Thibault <sthibault@debian.org> - 2021-02-26 21:30 +0100
    Bug#983589: w3m: Cannot verify certificates any more Tatsuya Kinoshita <tats@debian.org> - 2021-02-26 23:40 +0100
      Bug#983589: w3m: Cannot verify certificates any more Samuel Thibault <sthibault@debian.org> - 2021-02-27 00:00 +0100
        Bug#983589: w3m: Cannot verify certificates any more Tatsuya Kinoshita <tats@debian.org> - 2021-02-27 00:30 +0100
          Bug#983589: w3m: Cannot verify certificates any more Tatsuya Kinoshita <tats@debian.org> - 2021-02-27 01:00 +0100

#1049986 — Bug#983589: w3m: Cannot verify certificates any more

Package: w3m
Version: 0.5.3+git20210102-3
Severity: important

Hello,

Since version 0.5.3+git20210102-3 of w3m (downgrading to -2 fixes it),
all https website give me

unable to get local issuer certificate: accept? (y/n)

and choosing y gives

Accept unsecure SSL session: unverified: unable to get local issuer certificate

while choosing n quits.

This makes w3m vulnerable to spoofing. I almost thought about making
this a grave severity, since I believe we definitely don't want to keep
this bug in Bullseye.

Samuel

-- System Information:
Debian Release: bullseye/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable-debug'), (500, 'testing-debug'), (500, 'stable-debug'), (500, 'proposed-updates-debug'), (500, 'proposed-updates'), (500, 'oldoldstable'), (500, 'buildd-unstable'), (500, 'unstable'), (500, 'stable'), (500, 'oldstable'), (1, 'experimental-debug'), (1, 'buildd-experimental'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.11.0 (SMP w/8 CPU threads)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages w3m depends on:
ii  libc6      2.31-9
ii  libgc1     1:8.0.4-3
ii  libgpm2    1.20.7-8
ii  libssl1.1  1.1.1j-1
ii  libtinfo6  6.2+20201114-2
ii  zlib1g     1:1.2.11.dfsg-2

Versions of packages w3m recommends:
ii  ca-certificates  20210119

Versions of packages w3m suggests:
pn  cmigemo         <none>
ii  curl            7.74.0-1.1
ii  dict            1.13.0+dfsg-1
pn  dict-wn         <none>
pn  dictd           <none>
pn  libsixel-bin    <none>
ii  man-db          2.9.4-1
ii  mime-support    3.66
ii  mpv             0.32.0-2+b1
ii  sensible-utils  0.0.14
pn  w3m-el          <none>
ii  w3m-img         0.5.3+git20210102-2
ii  wget            1.21-1+b1
ii  xdg-utils       1.1.3-4
ii  xsel            1.2.0+git9bfc13d.20180109-3

-- no debconf information

-- 
Samuel
Actually, typing random strings in the Finder does the equivalent of
filename completion.
(Discussion in comp.os.linux.misc on the intuitiveness of commands: file
completion vs. the Mac Finder.)

[toc] | [next] | [standalone]

#1050000

[Multipart message — attachments visible in raw view] — view raw

On 2021-02-26 at 21:25 +0100, Samuel Thibault wrote:
> Since version 0.5.3+git20210102-3 of w3m (downgrading to -2 fixes it),
> all https website give me
>
> unable to get local issuer certificate: accept? (y/n)

Hmm, could you please tell me your configuration of ssl_ca_path
and ssl_ca_file in <~/.w3m/config> and </etc/w3m/config>?

The intentional change in -3 means that OpenSSL default paths will
not be loaded if you set ssl_ca_path or ssl_ca_file.

All the following should work in -3.

    w3m -dump -o ssl_ca_path= -o ssl_ca_file=/etc/ssl/certs/ca-certificates.crt https://www.debian.org
    w3m -dump -o ssl_ca_path=/etc/ssl/certs -o ssl_ca_file= https://www.debian.org
    w3m -dump -o ssl_ca_path= -o ssl_ca_file= https://www.debian.org

Thanks,
--
Tatsuya Kinoshita

[toc] | [prev] | [next] | [standalone]

#1050003

Tatsuya Kinoshita, le sam. 27 févr. 2021 07:36:20 +0900, a ecrit:
> On 2021-02-26 at 21:25 +0100, Samuel Thibault wrote:
> > Since version 0.5.3+git20210102-3 of w3m (downgrading to -2 fixes it),
> > all https website give me
> >
> > unable to get local issuer certificate: accept? (y/n)
> 
> Hmm, could you please tell me your configuration of ssl_ca_path
> and ssl_ca_file in <~/.w3m/config> and </etc/w3m/config>?

I have

ssl_ca_file
ssl_ca_path /etc/ssl/certs, ~/.ssl/certs

Samuel

[toc] | [prev] | [next] | [standalone]

#1050004

[Multipart message — attachments visible in raw view] — view raw

On 2021-02-26 at 23:54 +0100, Samuel Thibault wrote:
> ssl_ca_file
> ssl_ca_path /etc/ssl/certs, ~/.ssl/certs

Ah, multiple paths in ssl_ca_path is not supported.  The value
is directly passed to OpenSSL's SSL_CTX_load_verify_locations.
So, your configuration means the single nonexistence directory
"/etc/ssl/certs, ~/.ssl/certs" is used.

-2 implicitly adds OpenSSL default paths that helps you, but
I think this is a bug and fixed in -3.

Probably, you should set the following.

```
ssl_ca_file /etc/ssl/certs/ca-certificates.crt
ssl_ca_path ~/.ssl/certs
```

Thanks,
--
Tatsuya Kinoshita

[toc] | [prev] | [next] | [standalone]

#1050006

[Multipart message — attachments visible in raw view] — view raw

On 2021-02-27 at 08:22, Tatsuya Kinoshita wrote:
> -2 implicitly adds OpenSSL default paths that helps you, but
> I think this is a bug and fixed in -3.

However, this is a long-standing feature.  I'll reconsider
for the next upload.

Thanks,
--
Tatsuya Kinoshita

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web