Guest User

Untitled

a guest
Jul 9th, 2015
218
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. OpenSSL Security Advisory [9 Jul 2015]
  2. =======================================
  3.  
  4. Alternative chains certificate forgery (CVE-2015-1793)
  5. ======================================================
  6.  
  7. Severity: High
  8.  
  9. During certificate verification, OpenSSL (starting from version 1.0.1n and
  10. 1.0.2b) will attempt to find an alternative certificate chain if the first
  11. attempt to build such a chain fails. An error in the implementation of this
  12. logic can mean that an attacker could cause certain checks on untrusted
  13. certificates to be bypassed, such as the CA flag, enabling them to use a valid
  14. leaf certificate to act as a CA and "issue" an invalid certificate.
  15.  
  16. This issue will impact any application that verifies certificates including
  17. SSL/TLS/DTLS clients and SSL/TLS/DTLS servers using client authentication.
  18.  
  19. This issue affects OpenSSL versions 1.0.2c, 1.0.2b, 1.0.1n and 1.0.1o.
  20.  
  21. OpenSSL 1.0.2b/1.0.2c users should upgrade to 1.0.2d
  22. OpenSSL 1.0.1n/1.0.1o users should upgrade to 1.0.1p
  23.  
  24. This issue was reported to OpenSSL on 24th June 2015 by Adam Langley/David
  25. Benjamin (Google/BoringSSL). The fix was developed by the BoringSSL project.
  26.  
  27. Note
  28. ====
  29.  
  30. As per our previous announcements and our Release Strategy
  31. (https://www.openssl.org/about/releasestrat.html), support for OpenSSL versions
  32. 1.0.0 and 0.9.8 will cease on 31st December 2015. No security updates for these
  33. releases will be provided after that date. Users of these releases are advised
  34. to upgrade.
  35.  
  36. References
  37. ==========
  38.  
  39. URL for this Security Advisory:
  40. https://www.openssl.org/news/secadv_20150709.txt
  41.  
  42. Note: the online version of the advisory may be updated with additional
  43. details over time.
  44.  
  45. For details of OpenSSL severity classifications please see:
  46. https://www.openssl.org/about/secpolicy.html
RAW Paste Data