[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <55ED8FE6.9030805@redhat.com>
Date: Mon, 7 Sep 2015 15:23:50 +0200
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com,
Assign a CVE Identifier <cve-assign@...re.org>
Subject: nss: SSL_ImplementedCiphers ABI incompatibility may lead to incorrect
cipher suites
<https://bugzilla.redhat.com/show_bug.cgi?id=1260698>
“
It was discovered that the global SSL_ImplementedCiphers variable
increased its size as a result of nss package updates, an ABI
incompatibility. Due to the way ELF dynamic linking works, if the main
program was linke dagainst an older version of nss, then too little
space for the SSL_ImplementedCiphers variable is allocated, and its
contents is truncated. As a result, applications using the
SSL_ImplementedCiphers variables may not enable the intended set of a
TLS cipher suites.
”
Internally at Red Hat, we were not sure if this qualifies for a CVE.
(If so, it would likely be specific to Red Hat Enterprise Linux, because
upstream does not make such ABI guarantees as far as I know.)
To clarify, what happens is that: I compile application A on RHEL 7.0
against the original nss version. Then I upgrade to RHEL 7.1 (plus
security updates), and the intention is that nss will select a
different, larger set of cipher suites. However, the
SSL_ImplementedCiphers variable has been truncated, so this selection
process does not happen in the intended manner.
The Mozilla bug
<https://bugzilla.mozilla.org/show_bug.cgi?id=1201900>
contains some ideas how to deal with this issue.
--
Florian Weimer / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
