Package: libgnutls26 Version: 2.4.2-4 Severity: normal This was found as a result of the Ubuntu update to gnutls. This also affects the Ubuntu development release (which has the same version of gnutls26 as sid) and of course Debian Sid. For more information, please see:
https://launchpad.net/bugs/305264 Steps to reproduce: 1. apt-get install ca-certificates ldap-utils 2. LDAPTLS_CACERT=/etc/ssl/certs/ca-certificates.crt ldapsearch -ZZ -H ldaps://<public ldap server>:636/ -d 1 Result: ldap_url_parse_ext(ldaps://<public ldap server>:636/) ldap_create ldap_url_parse_ext(ldaps://<public ldap server>:636/??base) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP <public ldap server>:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying <public ip address>:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 TLS: peer cert untrusted or revoked (0x82) ldap_err2string ldap_start_tls: Can't contact LDAP server (-1) Expected result: .... ldap_open_defconn: successful .... What's most interesting is that gnutls-cli and certtool show the certificate as valid. I'd be happy to give the URL for the server off-list (I am reporting this on behalf of the initial reporter who did not divulge the information publicly. -- System Information: Debian Release: 5.0 APT prefers unstable APT policy: (500, 'unstable') Architecture: amd64 (x86_64) Kernel: Linux 2.6.27-7-generic (SMP w/2 CPU cores) Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968) Shell: /bin/sh linked to /bin/bash Versions of packages libgnutls26 depends on: ii libc6 2.7-16 GNU C Library: Shared libraries ii libgcrypt11 1.4.1-2 LGPL Crypto library - runtime libr ii libgpg-error0 1.4-2 library for common error values an ii libtasn1-3 1.5-1 Manage ASN.1 structures (runtime) ii zlib1g 1:1.2.3.3.dfsg-12 compression library - runtime libgnutls26 recommends no packages. Versions of packages libgnutls26 suggests: ii gnutls-bin 2.4.2-4 the GNU TLS library - commandline -- no debconf information -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
