[Bug 1094440] New: perl-libwww-perl: incorrect handling of SSL certificate verification

List overview All Threads
Download

newer

older

ppisar uploaded...

[Bug 1282917] Review Request:...

Red Hat Bugzilla

5 May 2014 5 May '14

6:05 p.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1094440

Bug ID: 1094440 Summary: perl-libwww-perl: incorrect handling of SSL certificate verification Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: vdanen@redhat.com CC: jkurik@redhat.com, mmaslano@redhat.com, perl-devel@lists.fedoraproject.org, perl-maint-list@redhat.com, ppisar@redhat.com, psabata@redhat.com

It was reported [1] that libwww-perl (LWP), when using IO::Socket::SSL (the default) and when the HTTPS_CA_DIR or HTTPS_CA_FILE environment variables were set, would disable server certificate verification. Judging by the commit [2], the intention was to disable only hostname verification for compatibility with Crypt::SSLeay, but the resultant effect is that SSL_verify_mode is set to 0. This code was introduced in LWP::Protocol::https in version 6.04, so earlier versions are not vulnerable.

Potential patches [3],[4] are being discussed upstream [5].

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746579 [2] https://github.com/dagolden/lwp-protocol-https/commit/bcc46ce2dab53d2e2baa58... [3] https://github.com/noxxi/lwp-protocol-https/commit/1b924708663f457a4f7c25ed3... [4] https://github.com/noxxi/lwp-protocol-https/commit/6b5c876de80451ee54de5d853... [5] https://github.com/libwww-perl/lwp-protocol-https/pull/14

Statement:

This issue did not affect the versions of perl-libwww-perl as shipped with Red Hat Enterprise Linux 5 and 6.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=6oOhABRd7w&a=cc_unsubscribe

Show replies by date

Red Hat Bugzilla

5 May 5 May

6:06 p.m.

New subject: [Bug 1094440] perl-libwww-perl: incorrect handling of SSL certificate verification

https://bugzilla.redhat.com/show_bug.cgi?id=1094440

Vincent Danen vdanen@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1094441

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=0LKNRMTxxX&a=cc_unsubscribe

Red Hat Bugzilla

6:07 p.m.

New subject: [Bug 1094440] perl-libwww-perl: incorrect handling of SSL certificate verification

https://bugzilla.redhat.com/show_bug.cgi?id=1094440

Vincent Danen vdanen@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1094442

--- Comment #1 from Vincent Danen vdanen@redhat.com ---

Created perl-libwww-perl tracking bugs for this issue:

Affects: fedora-all [bug 1094442]

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1094442 [Bug 1094442] perl-libwww-perl: incorrect handling of SSL certificate verification [fedora-all]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=KSWhfi3Cve&a=cc_unsubscribe

Red Hat Bugzilla

6 May 6 May

12:08 p.m.

New subject: [Bug 1094440] perl-libwww-perl: incorrect handling of SSL certificate verification

https://bugzilla.redhat.com/show_bug.cgi?id=1094440

Petr Pisar ppisar@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Vx5pSbDRtm&a=cc_unsubscribe

Red Hat Bugzilla

7 May 7 May

3:59 p.m.

New subject: [Bug 1094440] perl-libwww-perl: incorrect handling of SSL certificate verification

https://bugzilla.redhat.com/show_bug.cgi?id=1094440

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Alias| |CVE-2014-3230

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=CGgBi4YIR5&a=cc_unsubscribe

Red Hat Bugzilla

3:59 p.m.

New subject: [Bug 1094440] CVE-2014-3230 perl-libwww-perl: incorrect handling of SSL certificate verification

https://bugzilla.redhat.com/show_bug.cgi?id=1094440

Martin Prpic mprpic@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=BiVAfI5hvM&a=cc_unsubscribe

Red Hat Bugzilla

4 p.m.

New subject: [Bug 1094440] CVE-2014-3230 perl-libwww-perl: incorrect handling of SSL certificate verification

https://bugzilla.redhat.com/show_bug.cgi?id=1094440

--- Comment #3 from Martin Prpic mprpic@redhat.com --- MITRE assigned CVE-2014-3230 to this issue:

http://seclists.org/oss-sec/2014/q2/256

^ also states that additional CVEs may be assigned later.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=yvrrpIibMq&a=cc_unsubscribe

Red Hat Bugzilla

8 May 8 May

4:16 p.m.

New subject: [Bug 1094440] CVE-2014-3230 perl-libwww-perl: incorrect handling of SSL certificate verification

https://bugzilla.redhat.com/show_bug.cgi?id=1094440

--- Comment #5 from Petr Pisar ppisar@redhat.com --- Created attachment 893659 --> https://bugzilla.redhat.com/attachment.cgi?id=893659&action=edit Test case

This is an automated test. It requires openssl(1) and some Perl modules. It checks how HTTPS_CA_FILE environment variable influences LWP::UserAgent behavior regarding certificate verification.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=pJiiRktf30&a=cc_unsubscribe

Red Hat Bugzilla

9 May 9 May

9:32 a.m.

New subject: [Bug 1094440] CVE-2014-3230 perl-libwww-perl: incorrect handling of SSL certificate verification

https://bugzilla.redhat.com/show_bug.cgi?id=1094440

Petr Pisar ppisar@redhat.com changed:

--- Comment #6 from Petr Pisar ppisar@redhat.com --- Created attachment 893881 --> https://bugzilla.redhat.com/attachment.cgi?id=893881&action=edit Test case

Quoting colon in the network address fixed.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=URABiJto1w&a=cc_unsubscribe

Red Hat Bugzilla

12 May 12 May

1:27 p.m.

New subject: [Bug 1094440] CVE-2014-3230 perl-libwww-perl: incorrect handling of SSL certificate verification

https://bugzilla.redhat.com/show_bug.cgi?id=1094440

--- Comment #7 from Petr Pisar ppisar@redhat.com --- Created attachment 894671 --> https://bugzilla.redhat.com/attachment.cgi?id=894671&action=edit Proposed fix (part 1)

...

From https://github.com/noxxi/lwp-protocol-https.git.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=uSsYNYrycd&a=cc_unsubscribe

Red Hat Bugzilla

1:28 p.m.

New subject: [Bug 1094440] CVE-2014-3230 perl-libwww-perl: incorrect handling of SSL certificate verification

https://bugzilla.redhat.com/show_bug.cgi?id=1094440

--- Comment #8 from Petr Pisar ppisar@redhat.com --- Created attachment 894672 --> https://bugzilla.redhat.com/attachment.cgi?id=894672&action=edit Proposed fix (part 2)

...

From https://github.com/noxxi/lwp-protocol-https.git.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=URNL1ukAgU&a=cc_unsubscribe

Red Hat Bugzilla

3:46 p.m.

New subject: [Bug 1094440] CVE-2014-3230 perl-libwww-perl: incorrect handling of SSL certificate verification

https://bugzilla.redhat.com/show_bug.cgi?id=1094440

--- Comment #9 from Petr Pisar ppisar@redhat.com --- Created attachment 894747 --> https://bugzilla.redhat.com/attachment.cgi?id=894747&action=edit Part 1 ported to 6.04

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=amuUjZCiUf&a=cc_unsubscribe

Red Hat Bugzilla

3:47 p.m.

New subject: [Bug 1094440] CVE-2014-3230 perl-libwww-perl: incorrect handling of SSL certificate verification

https://bugzilla.redhat.com/show_bug.cgi?id=1094440

--- Comment #10 from Petr Pisar ppisar@redhat.com --- Created attachment 894748 --> https://bugzilla.redhat.com/attachment.cgi?id=894748&action=edit Part 2 ported to 6.04

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=QfbJ8fwRrI&a=cc_unsubscribe

Red Hat Bugzilla

13 May 13 May

1:50 p.m.

New subject: [Bug 1094440] CVE-2014-3230 perl-libwww-perl: incorrect handling of SSL certificate verification

https://bugzilla.redhat.com/show_bug.cgi?id=1094440

--- Comment #11 from Petr Pisar ppisar@redhat.com --- Created attachment 895124 --> https://bugzilla.redhat.com/attachment.cgi?id=895124&action=edit Part3 for 6.04 to restore behavior in F19

This patch is needed for F19 only because there is old IO::Socket::SSL which still defaults to no peer certificate verification.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=L4V2qLfNiU&a=cc_unsubscribe

Red Hat Bugzilla

22 May 22 May

12:22 a.m.

New subject: [Bug 1094440] CVE-2014-3230 perl-libwww-perl: incorrect handling of SSL certificate verification

https://bugzilla.redhat.com/show_bug.cgi?id=1094440

--- Comment #12 from Fedora Update System updates@fedoraproject.org --- perl-LWP-Protocol-https-6.04-4.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=OYpssDaYln&a=cc_unsubscribe

Red Hat Bugzilla

23 May 23 May

7:55 p.m.

New subject: [Bug 1094440] CVE-2014-3230 perl-libwww-perl: incorrect handling of SSL certificate verification

https://bugzilla.redhat.com/show_bug.cgi?id=1094440

--- Comment #13 from Fedora Update System updates@fedoraproject.org --- perl-LWP-Protocol-https-6.04-2.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=BOHNWHBrGm&a=cc_unsubscribe

Red Hat Bugzilla

26 May 26 May

2:36 p.m.

New subject: [Bug 1094440] CVE-2014-3230 perl-libwww-perl: incorrect handling of SSL certificate verification

https://bugzilla.redhat.com/show_bug.cgi?id=1094440 Bug 1094440 depends on bug 1094442, which changed state.

Bug 1094442 Summary: perl-libwww-perl: incorrect handling of SSL certificate verification [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1094442

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=cP4L9Zkffn&a=cc_unsubscribe

Red Hat Bugzilla

5 Jun 5 Jun

10:32 p.m.

New subject: [Bug 1094440] CVE-2014-3230 perl-libwww-perl: incorrect handling of SSL certificate verification

https://bugzilla.redhat.com/show_bug.cgi?id=1094440

Tomas Hoger thoger@redhat.com changed:

--- Comment #14 from Tomas Hoger thoger@redhat.com --- (In reply to Vincent Danen from comment #0)

...

This issue did not affect the versions of perl-libwww-perl as shipped with Red Hat Enterprise Linux 5 and 6.

It should be noted that versions of perl-libwww-perl in Red Hat Enterprise Linux 6 do not perform SSL certificate verification by default (see bug 705044, including an example of how to enable certificate checks in IO::Socket::SSL in bug 705044 comment 7). The change to enable SSL verification by default was made upstream in version 6.0.

Upstream version 6.0 also introduced ways to control certificate verification:

- Via LWP::UserAgent ssl_opts attribute: http://search.cpan.org/dist/libwww-perl/lib/LWP/UserAgent.pm#ATTRIBUTES

These allow specifying a path to file (SSL_ca_file) or directory (SSL_ca_path) with CA certificates, and whether host name verification should be performed (verify_hostname). If these are not set in a script, environment variables are checked in the following order:

- PERL_LWP_SSL_* variables first, including: PERL_LWP_SSL_VERIFY_HOSTNAME, PERL_LWP_SSL_CA_FILE, and PERL_LWP_SSL_CA_PATH

- HTTPS_CA_* if PERL_LWP_SSL_* are not set: HTTPS_CA_FILE, and HTTPS_CA_DIR. When these are used, host name verification is automatically disabled (for backwards compatibility).

The problem here is that when host name verification is disabled, certificate verification is disabled as well (unless explicitly requested using IO::Socket::SSL's SSL_verify_mode). One such example is the use of HTTPS_CA_* environment variables.

LWP::UserAgent documentation is scarce and ambiguous in defining whether verify_hostname 0 is supposed to only disable hostname check, or all certificate checks. The code seems to assume all checks are disabled. However, that's not really compatible with the (undocumented) assumption that HTTPS_CA_* environment variables are meant to enable certificate checks and only disable hostname checks.

Note that use when certificate is checked without checking hostname is usually insecure, as malicious site can obtain SSL certificate from a trusted CA for a different name and still have it accepted as valid for different host.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=k841EpU7Ms&a=cc_unsubscribe

Red Hat Bugzilla

27 Nov 27 Nov

3:12 p.m.

New subject: [Bug 1094440] CVE-2014-3230 perl-libwww-perl: incorrect handling of SSL certificate verification

https://bugzilla.redhat.com/show_bug.cgi?id=1094440

Tomas Hoger thoger@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

30 Nov 30 Nov

7:19 a.m.

New subject: [Bug 1094440] CVE-2014-3230 perl-libwww-perl: incorrect handling of SSL certificate verification

https://bugzilla.redhat.com/show_bug.cgi?id=1094440

Ján Rusnačko jrusnack@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

3133

Age (days ago)

3707

Last active (days ago)

perl-devel@lists.fedoraproject.org

19 comments

1 participants

tags (0)

participants (1)

Red Hat Bugzilla