Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1049986

Bug#983589: w3m: Cannot verify certificates any more

Show all headers | View raw

Package: w3m
Version: 0.5.3+git20210102-3
Severity: important

Hello,

Since version 0.5.3+git20210102-3 of w3m (downgrading to -2 fixes it),
all https website give me

unable to get local issuer certificate: accept? (y/n)

and choosing y gives

Accept unsecure SSL session: unverified: unable to get local issuer certificate

while choosing n quits.

This makes w3m vulnerable to spoofing. I almost thought about making
this a grave severity, since I believe we definitely don't want to keep
this bug in Bullseye.

Samuel

-- System Information:
Debian Release: bullseye/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable-debug'), (500, 'testing-debug'), (500, 'stable-debug'), (500, 'proposed-updates-debug'), (500, 'proposed-updates'), (500, 'oldoldstable'), (500, 'buildd-unstable'), (500, 'unstable'), (500, 'stable'), (500, 'oldstable'), (1, 'experimental-debug'), (1, 'buildd-experimental'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.11.0 (SMP w/8 CPU threads)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages w3m depends on:
ii  libc6      2.31-9
ii  libgc1     1:8.0.4-3
ii  libgpm2    1.20.7-8
ii  libssl1.1  1.1.1j-1
ii  libtinfo6  6.2+20201114-2
ii  zlib1g     1:1.2.11.dfsg-2

Versions of packages w3m recommends:
ii  ca-certificates  20210119

Versions of packages w3m suggests:
pn  cmigemo         <none>
ii  curl            7.74.0-1.1
ii  dict            1.13.0+dfsg-1
pn  dict-wn         <none>
pn  dictd           <none>
pn  libsixel-bin    <none>
ii  man-db          2.9.4-1
ii  mime-support    3.66
ii  mpv             0.32.0-2+b1
ii  sensible-utils  0.0.14
pn  w3m-el          <none>
ii  w3m-img         0.5.3+git20210102-2
ii  wget            1.21-1+b1
ii  xdg-utils       1.1.3-4
ii  xsel            1.2.0+git9bfc13d.20180109-3

-- no debconf information

-- 
Samuel
Actually, typing random strings in the Finder does the equivalent of
filename completion.
(Discussion in comp.os.linux.misc on the intuitiveness of commands: file
completion vs. the Mac Finder.)

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#983589: w3m: Cannot verify certificates any more Samuel Thibault <sthibault@debian.org> - 2021-02-26 21:30 +0100
  Bug#983589: w3m: Cannot verify certificates any more Tatsuya Kinoshita <tats@debian.org> - 2021-02-26 23:40 +0100
    Bug#983589: w3m: Cannot verify certificates any more Samuel Thibault <sthibault@debian.org> - 2021-02-27 00:00 +0100
      Bug#983589: w3m: Cannot verify certificates any more Tatsuya Kinoshita <tats@debian.org> - 2021-02-27 00:30 +0100
        Bug#983589: w3m: Cannot verify certificates any more Tatsuya Kinoshita <tats@debian.org> - 2021-02-27 01:00 +0100

csiph-web