Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 572950 (CVE-2016-2047) - dev-db/mariadb: SSL certificate validation
Summary: dev-db/mariadb: SSL certificate validation
Status: RESOLVED FIXED
Alias: CVE-2016-2047
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: http://www.openwall.com/lists/oss-sec...
Whiteboard: B3 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2016-01-26 08:50 UTC by Agostino Sarubbo
Modified: 2016-03-21 23:51 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2016-01-26 08:50:11 UTC
From ${URL} :

MariaDB (as well as MySQL and Percona Server) has an option to validate
server certificate, when establishing an SSL connection. It checks that
the certificate belongs to the host that the client wants to connect to.
This validation, of course, should normally always be enabled to prevent
MITM attacks.

Recently (end of November) two security researchers Paul Kehrer and Alex
Gaynor have found a flaw in this certificate validation code that allows
to trick it into accepting certificate from other hosts. For example,
if the host 'foo.com' has a certificate with the "Organizational Unit"
being, say, "/CN=bar.com", then MariaDB client will see the result as

   /OU=/CN=bar.com/CN=foo.com

and will think that this certificate belongs to bar.com. This bugs is in
15 year old code and is present in all MariaDB/MySQL/Percona Server
versions. 

This vulnerability got CVE-2016-2047.

It is fixed in MariaDB 5.5.47, MariaDB 10.0.23, MariaDB 10.1.10
(all released in December).


@maintainer(s): since the fixed package is already in the tree, please let us know if it is ready for the stabilization or not.
Comment 1 Brian Evans Gentoo Infrastructure gentoo-dev 2016-03-21 19:54:43 UTC
All affected versions were stabled and removed as part of bug 572872
Comment 2 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2016-03-21 23:44:42 UTC
Tracking all in bug 572872.
Comment 3 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2016-03-21 23:51:28 UTC
CVE already included in dependent bug.  Closing.