From ${URL} : The default_tls_x509_verify (and related) parameters in qemu.conf control whether the TLS servers in QEMU request & verify certificates from clients. This works as a simple access control system for QEMU servers by requiring the CA to issue certs to permitted clients. This use of client certificates is disabled by default, since it requires extra work to issue client certificates. Unfortunately the libvirt code was using these configuration parameters when setting up both TLS clients and servers in QEMU. The result was that TLS clients for character devices and disk devices had verification turned off, meaning they would ignore any errors while validating the server certificate. A MITM attacker can attack any client connection made by QEMU's character devices and disk devices which have TLS enabled. The attacker can send an arbitrary certificate back to the client QEMU and it will ignore all errors that result during validation. References: https://www.redhat.com/archives/libvirt-announce/2017-October/msg00001.html @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Fixed in 3.8.0-r1. Vulnerable version left in tree: 3.6.0 Let's wait until Friday for stabilization. commit 834dafc5a7928ecf8c1e643dd2879837d32d233c Author: Matthias Maier <tamiko@gentoo.org> Date: Wed Oct 25 14:46:02 2017 -0500 app-emulation/libvirt: fix CVE-2017-1000256, bug #635174 Package-Manager: Portage-2.3.8, Repoman-2.3.3
Arches, please stabilize =app-emulation/libvirt-3.8.0-r1 Target-keywords: amd64 x86
x86 stable
amd6 stable
Tree clean. commit 5d6f35fa50d81d06f2da8427d6ab6662100b38aa Author: Matthias Maier <tamiko@gentoo.org> Date: Tue Nov 14 18:19:38 2017 -0600 app-emulation/libvirt: drop vulnerable (bug #635174) Package-Manager: Portage-2.3.13, Repoman-2.3.4
Thank you all. GLSA Vote: No
