oss-security - CVE request: hs-tls: Basic constraints vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130120123233.GA16558@elende>
Date: Sun, 20 Jan 2013 13:32:33 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Subject: CVE request: hs-tls: Basic constraints vulnerability

Hi

For hs-tls (TLS/SSL implementation in haskell) it was announced the following
advisory[0]:

----cut---------cut---------cut---------cut---------cut---------cut-----
Hi cafe,

this is a security advisory for tls-extra < 0.6.1 which are all vulnerable to bad
certificate validation.

Some part of the certificate validation procedure were missing (relying on the
work-in-progress x509 v3 extensions), and because of this anyone with a correct
end-entity certificate can issue certificate for any arbitrary domain, i.e.
acting as a CA.

This problem has been fixed in tls-extra 0.6.1, and I advise everyone to upgrade as
soon as possible.

Despite a very serious flaw in the certificate validation, I'm happy that the
code is seeing some audits, and would want to thanks Ertugrul Söylemez for the
findings [1].

[1] https://github.com/vincenthz/hs-tls/issues/29
----cut---------cut---------cut---------cut---------cut---------cut-----

According to the upstream issue it should be fixed with commit [2].

 [0]: http://www.haskell.org/pipermail/haskell-cafe/2013-January/105842.html
 [2]: https://github.com/vincenthz/hs-tls/commit/15885c0649ceabd2f4d2913df8ac6dc63d6b3b37

Could a CVE for this issue be assigned?

Regards,
Salvatore

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.