[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 7 Aug 2021 09:17:55 -0500 (CDT)
From: Ariadne Conill <ariadne@...eferenced.org>
To: oss-security@...ts.openwall.com
cc: Axel Beckert <abe@...ian.org>, lynx-dev@...gnu.org, security@...ian.org,
991971@...s.debian.org
Subject: Re: Re: [Lynx-dev] bug in Lynx' SSL certificate
validation -> leaks password in clear text via SNI (under some
circumstances)
Hi,
On Sat, 7 Aug 2021, Thorsten Glaser wrote:
> Axel Beckert dixit:
>
>> This is more severe than it initially looked like: Due to TLS Server
>> Name Indication (SNI) the hostname as parsed by Lynx (i.e with
>> "user:pass@" included) is sent in _clear_ text over the wire even
>
> I *ALWAYS* SAID SNI IS A SHIT THING ONLY USED AS BAD EXCUSE FOR NAT
> BY PEOPLE WHO ARE TOO STUPID TO CONFIGURE THEIR SERVERS RIGHT AND AS
> BAD EXCUSE FOR LACKING IPv6 SUPPORT, AND THEN THE FUCKING IDIOTS WENT
> AND MADE SNI *MANDATORY* FOR TLSv1.3, AND I FEEL *SO* VINDICATED RIGHT
> NOW! IDIOTS IN CHARGE OF SECURITY, FUCKING IDIOTS…
It turns out SNI is only marginally related to this issue. The issue
itself is far more severe: HTParse() does not understand the authn part of
the URI at all. And so, when you call:
HTParse("https://foo:bar@...mple.com", "", PARSE_HOST)
It returns:
foo:bar@...mple.com
Which is then handed directly to SSL_set_tlsext_host_name() or
gnutls_server_name_set(). But it will also leak in the Host: header on
unencrypted connections, and also probably SSL ones too.
As a workaround, I taught HTParse() how to parse the authn part of URIs,
but Lynx itself needs to actually properly support the authn part really.
I have attached the patch Alpine is using to work around this infoleak.
Ariadne
View attachment "fix-auth-data-leaks.patch" of type "text/plain" (1480 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
