Date: Mon, 7 Sep 2015 15:23:50 +0200 From: Florian Weimer <fweimer@...hat.com> To: oss-security@...ts.openwall.com, Assign a CVE Identifier <cve-assign@...re.org> Subject: nss: SSL_ImplementedCiphers ABI incompatibility may lead to incorrect cipher suites <https://bugzilla.redhat.com/show_bug.cgi?id=1260698> “ It was discovered that the global SSL_ImplementedCiphers variable increased its size as a result of nss package updates, an ABI incompatibility. Due to the way ELF dynamic linking works, if the main program was linke dagainst an older version of nss, then too little space for the SSL_ImplementedCiphers variable is allocated, and its contents is truncated. As a result, applications using the SSL_ImplementedCiphers variables may not enable the intended set of a TLS cipher suites. ” Internally at Red Hat, we were not sure if this qualifies for a CVE. (If so, it would likely be specific to Red Hat Enterprise Linux, because upstream does not make such ABI guarantees as far as I know.) To clarify, what happens is that: I compile application A on RHEL 7.0 against the original nss version. Then I upgrade to RHEL 7.1 (plus security updates), and the intention is that nss will select a different, larger set of cipher suites. However, the SSL_ImplementedCiphers variable has been truncated, so this selection process does not happen in the intended manner. The Mozilla bug <https://bugzilla.mozilla.org/show_bug.cgi?id=1201900> contains some ideas how to deal with this issue. -- Florian Weimer / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ