[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 17 Oct 2012 12:42:53 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Raphael Geissert <geissert@...ian.org>
Subject: Re: CVE request: radsecproxy incorrect x.509 certificate
validation
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 10/17/2012 11:48 AM, Raphael Geissert wrote:
> Hi,
>
> Ralf Paffrath discovered that radsecproxy may incorrectly accept a
> client certificate if the certificates chain was validated with the
> CA settings of one configuration block but the other certificate
> constraints failed, and the certificate constraints of another
> configuration block passed (ignoring this other config block's CA
> settings.)
>
> This issue has been fixed in version 1.6.1. However, it introduces
> a minor regression as it ignores some configuration blocks (see the
> references for further details.)
>
> Could a CVE id be assigned?
>
> Thanks in advance.
>
> References: https://project.nordu.net/browse/RADSECPROXY-43
> https://postlister.uninett.no/sympa/arc/radsecproxy/2012-09/msg00001.html
>
>
https://postlister.uninett.no/sympa/arc/radsecproxy/2012-09/msg00006.html
>
Please use CVE-2012-4523 for this issue.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iQIcBAEBAgAGBQJQfvwtAAoJEBYNRVNeJnmT2BAP/2A5V4oLMJf8oxfmrjwjHjf5
2hlcIYZtn0ScmAMfCkKIyxW99qftyV82yp21jSkdTER0LA+U8go40p6YhUAfSxDQ
yaaIemJo0vKVLVNksa9PosrugFEoqF2P7olVKRtRyvuhLTizih4jwg04Mxq7s6S5
Y/8KOCWLrdyJsYTrNFpfDfCxOLiBgVNdR6pxu5t8BMQ1UrW2INqcvCHrfM9m6hKG
3WI2UUDUJZoEGsZwARYPQEoxpq0/rRyyos7YrofnATSaf0m/xI7zUCi585KxYigd
n4mz9h5A9NSzm0p4B4AAOeBxR2T7J8BPHDEzIcVibYbm6GX9nxINcgr4Us6KWKkV
NZvkAYXlQhXPliOQrwhS9Wan6YgwBLc/zQdLBghO8dA/pdpBAOQXyUWz2nVM2KjQ
n30jsM+Dgby+74WuaTAKjzuW7ooaE4Et4//DxFIqJYMk4kYAJJrrH7Wl0Rku4agb
Vo37rM0aZzzu1udPciuEdwLckvnNRl9ZypYRxG2TQGWOxbKPflMfNUmxZB6f3pp9
3gXUI2nsysXJL9W3BEZ95BVJLqzhVwDygLP9Ikwd1e+Lse+yGD7HD85x3gT4obuk
eyhl+7YAFSbxbp7UrjK1/3c2WO/Ze0rh3tRd2zo/P2N1/U/qgYrUMIUs6bP3b8nS
nb0+JTm68XmEwEu02T+A
=BwI6
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
