[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201210301346.21627.geissert@debian.org>
Date: Tue, 30 Oct 2012 13:46:21 -0600
From: Raphael Geissert <geissert@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: radsecproxy incorrect x.509 certificate validation
Hi again,
On Wednesday 17 October 2012 12:48:19 Raphael Geissert wrote:
> Ralf Paffrath discovered that radsecproxy may incorrectly accept a client
> certificate if the certificates chain was validated with the CA settings
> of one configuration block but the other certificate constraints failed,
> and the certificate constraints of another configuration block passed
> (ignoring this other config block's CA settings.)
>
> This issue has been fixed in version 1.6.1. However, it introduces a
> minor regression as it ignores some configuration blocks (see the
> references for further details.)
While checking the issue I noticed that the same issue also affects
radsecproxy's DTLS support, which was not fixed. Upstream has now released
version 1.6.2 addressing the vulnerability in its DTLS support code.
Now, the thing is that upstream re-used the previously assigned CVE id
CVE-2012-4523. According to the guidelines a new id should be assigned since
they affect different versions even if the issues are related.
So, I guess a new id is in order?
References:
http://git.nordu.net/?p=radsecproxy.git;a=commit;h=3682c935facf5ccd7fa600644bbb76957155c680
https://postlister.uninett.no/sympa/arc/radsecproxy/2012-10/msg00001.html
https://project.nordu.net/browse/RADSECPROXY-43
Regards,
--
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
