| Summary: | dev-db/mariadb: SSL certificate validation | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | minor | CC: | hasufell, mysql-bugs |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://www.openwall.com/lists/oss-security/2016/01/26/3 | ||
| Whiteboard: | B3 [noglsa] | ||
| Package list: | Runtime testing required: | --- | |
All affected versions were stabled and removed as part of bug 572872 Tracking all in bug 572872. CVE already included in dependent bug. Closing. |
From ${URL} : MariaDB (as well as MySQL and Percona Server) has an option to validate server certificate, when establishing an SSL connection. It checks that the certificate belongs to the host that the client wants to connect to. This validation, of course, should normally always be enabled to prevent MITM attacks. Recently (end of November) two security researchers Paul Kehrer and Alex Gaynor have found a flaw in this certificate validation code that allows to trick it into accepting certificate from other hosts. For example, if the host 'foo.com' has a certificate with the "Organizational Unit" being, say, "/CN=bar.com", then MariaDB client will see the result as /OU=/CN=bar.com/CN=foo.com and will think that this certificate belongs to bar.com. This bugs is in 15 year old code and is present in all MariaDB/MySQL/Percona Server versions. This vulnerability got CVE-2016-2047. It is fixed in MariaDB 5.5.47, MariaDB 10.0.23, MariaDB 10.1.10 (all released in December). @maintainer(s): since the fixed package is already in the tree, please let us know if it is ready for the stabilization or not.