oss-security - Re: CVE Request -- Mercurial --Doesn't verify subject Common Name properly

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <890354492.159911286826519275.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Mon, 11 Oct 2010 15:48:39 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Bill Janssen <bill.janssen@...il.com>,
        Andreas Hasenack <ahasenack@...ra.com.br>,
        Mads Kiilerich <mads@...lerich.com>,
        "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE Request -- Mercurial --Doesn't verify
 subject Common Name properly

Steve,

Can I defer this one to MITRE? My initial thought is that python should get
the ID, but they seem to want to push it up to the application developers,
but they also added some functionality in
http://svn.python.org/view?view=rev&revision=85321

Is there a past precedent for this?

Thanks.

-- 
    JB


----- "Jan Lieskovsky" <jlieskov@...hat.com> wrote:

> Hello Steve, vendors,
> 
>    a security flaw was found in the way Mercurial handled subject
> Common Name field of the provided certificate (the check
> if the commonName in the received certificate matches the
> requested hostname was not performed). An attacker, able
> to get a carefully-crafted certificate signed by a Certificate
> Authority could use the certificate during a man-in-the-middle
> attack and potentially confuse Mercurial into accepting it by
> mistake.
> 
> References:
> [1] http://mercurial.selenic.com/bts/issue2407
> [2] https://bugzilla.redhat.com/show_bug.cgi?id=641373
> [3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598841
> Upstream patch:
> [4]
> http://selenic.com/repo/hg-stable/diff/f2937d6492c5/mercurial/url.py
> 
> According to [1] the true reason for this problem is the new python
> SSL
> module implementation:
> [5] http://bugs.python.org/issue1589
> [6] http://svn.python.org/view?view=rev&revision=85321
> 
> and as stated in:
> [7] http://bugs.python.org/issue1589#msg58472
> 
> it should be decision made by application designers, if the subject
> CN
> field will be checked despite of the python SSL module
> implementation.
> 
> So could you allocate a CVE identifier for this issue(s)?
> 
> Thanks && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.