The Patching Friars' AlmanacA calendar of CVE saints

February 22

goto fail;Holy card for gotofail, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 if (err) goto fail; goto fail; goto fail; BIS DICTUM, NIHIL PROBATUM
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint goto fail, of the Doubled Line

Patron of duplicated lines, if statements without braces, and distracted code reviewers.

Life

On 21 February 2014 Apple shipped iOS 7.0.6 with a terse note about SSL verification; the next day Adam Langley explained why. In the Secure Transport code a "goto fail;" line appeared twice in a row: the second always skipped the signature check, and any attacker in the middle could pose as a secure site. One line copied twice, and the padlock on iOS and macOS stayed open.

Prayer

O Saint goto fail, who always jumps where he shouldn't, teach us to add braces even when they seem pointless. Amen.

How to celebrate

Celebrated by updating to iOS 7.0.6 and OS X 10.9.2, turning on unreachable-code warnings, and singing the song written in his honour.

Double the line, halve the security.

Technical record

Disclosed on
February 22 2014
CVE
CVE-2014-1266

The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step.

Sources: gotofail.com · imperialviolet.org · music.apple.com

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.