[Bug 1147324] New: CVE-2014-7189 golang: TLS client authentication issue fixed in version 1.3.2
https://bugzilla.redhat.com/show_bug.cgi?id=1147324
Bug ID: 1147324 Summary: CVE-2014-7189 golang: TLS client authentication issue fixed in version 1.3.2 Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: mmcallis@redhat.com CC: admiller@redhat.com, golang@lists.fedoraproject.org, lemenkov@gmail.com, lsm5@fedoraproject.org, renich@woralelandia.com, s@shk.io, vbatts@redhat.com
The Go 1.3.2 release fixes the following issue:
"The crpyto/tls fix addresses a security bug that affects programs that use crypto/tls to implement a TLS server from Go 1.1 onwards. If the server enables TLS client authentication using certificates (this is rare) and explicitly sets SessionTicketsDisabled to true in the tls.Config, then a malicious client can falsely assert ownership of any client certificate it wishes."
Upstream fix:
https://code.google.com/p/go/source/detail?r=eae0457c101512f59296538f0162749...
References:
http://seclists.org/oss-sec/2014/q3/749
https://bugzilla.redhat.com/show_bug.cgi?id=1147324
Murray McAllister mmcallis@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1147325 Depends On| |1147326 Depends On| |1147327
--- Comment #1 from Murray McAllister mmcallis@redhat.com ---
Created golang tracking bugs for this issue:
Affects: fedora-all [bug 1147325] Affects: epel-6 [bug 1147326] Affects: epel-7 [bug 1147327]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1147325 [Bug 1147325] CVE-2014-7189 golang: TLS client authentication issue fixed in version 1.3.2 [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1147326 [Bug 1147326] CVE-2014-7189 golang: TLS client authentication issue fixed in version 1.3.2 [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1147327 [Bug 1147327] CVE-2014-7189 golang: TLS client authentication issue fixed in version 1.3.2 [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=1147324
--- Comment #2 from Vincent Batts vbatts@redhat.com --- More information: https://groups.google.com/forum/#!msg/golang-nuts/eeOHNw_shwU/OHALUmroA5kJ
I'll start the process for getting go1.3.2 out for these releases
https://bugzilla.redhat.com/show_bug.cgi?id=1147324 Bug 1147324 depends on bug 1147325, which changed state.
Bug 1147325 Summary: CVE-2014-7189 golang: TLS client authentication issue fixed in version 1.3.2 [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1147325
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1147324
--- Comment #3 from Fedora Update System updates@fedoraproject.org --- golang-1.3.3-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1147324
--- Comment #4 from Fedora Update System updates@fedoraproject.org --- golang-1.3.3-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1147324
--- Comment #5 from Fedora Update System updates@fedoraproject.org --- golang-1.3.3-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1147324 Bug 1147324 depends on bug 1147327, which changed state.
Bug 1147327 Summary: CVE-2014-7189 golang: TLS client authentication issue fixed in version 1.3.2 [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1147327
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1147324
--- Comment #6 from Fedora Update System updates@fedoraproject.org --- golang-1.3.3-1.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1147324 Bug 1147324 depends on bug 1147326, which changed state.
Bug 1147326 Summary: CVE-2014-7189 golang: TLS client authentication issue fixed in version 1.3.2 [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1147326
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1147324
--- Comment #7 from Fedora Update System updates@fedoraproject.org --- golang-1.3.3-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1147324
Ján Rusnačko jrusnack@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2014 |impact=moderate,public=2014 |0925,reported=20140926,sour |0925,reported=20140926,sour |ce=osssecurity,cvss2=5.8/AV |ce=oss-security,cvss2=5.8/A |:N/AC:M/Au:N/C:P/I:P/A:N,fe |V:N/AC:M/Au:N/C:P/I:P/A:N,f |dora-all/golang=affected,ep |edora-all/golang=affected,e |el-6/golang=affected,epel-7 |pel-6/golang=affected,epel- |/golang=affected |7/golang=affected
golang@lists.fedoraproject.org
-
Red Hat Bugzilla