https://bugzilla.redhat.com/show_bug.cgi?id=1093273
Bug ID: 1093273 Summary: CVE-2014-0363 smack: incorrect X.509 validation Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: mmcallis@redhat.com CC: java-sig-commits@lists.fedoraproject.org, puntogil@libero.it, weli@redhat.com
Common Vulnerabilities and Exposures assigned an identifier CVE-2014-0363 to the following vulnerability:
Name: CVE-2014-0363 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0363 Assigned: 20131205 Reference: http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-h... Reference: http://issues.igniterealtime.org/browse/SMACK-410 Reference: CERT-VN:VU#489228 Reference: http://www.kb.cert.org/vuls/id/489228
The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain.
The man-in-the-middle attacker requires a certificate that is valid for any domain name.
Upstream patch: http://fisheye.igniterealtime.org/changelog/smackgit?cs=93030c218c62cf0a0a8e...
From code inspection, this issue affects the 3.2.2 version in Fedora (the CERT
advisory mentions version 3.4.1 and possibly earlier versions).
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
Murray McAllister mmcallis@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1093274
--- Comment #1 from Murray McAllister mmcallis@redhat.com ---
Created smack tracking bugs for this issue:
Affects: fedora-all [bug 1093274]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1093274 [Bug 1093274] CVE-2014-0363 smack: incorrect X.509 validation [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
Murray McAllister mmcallis@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|CVE-2014-0363 smack: |CVE-2014-0363 smack: |incorrect X.509 validation |incorrect X.509 certificate | |validation
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
Murray McAllister mmcallis@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1093275
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
Arun Babu Neelicattu aneelica@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |aneelica@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2013 |impact=moderate,public=2013 |0206,reported=20140430,sour |0206,reported=20140430,sour |ce=cvenew,cvss2=4.3/AV:N/AC |ce=cvenew,cvss2=4.3/AV:N/AC |:M/Au:N/C:N/I:P/A:N,fedora- |:M/Au:N/C:N/I:P/A:N,fedora- |all/smack=affected,jboss/an |all/smack=affected,jboss/an |ything=new |ything=new,brms-6/smack=aff | |ected
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2013 |impact=moderate,public=2013 |0206,reported=20140430,sour |0206,reported=20140430,sour |ce=cvenew,cvss2=4.3/AV:N/AC |ce=cvenew,cvss2=4.3/AV:N/AC |:M/Au:N/C:N/I:P/A:N,fedora- |:M/Au:N/C:N/I:P/A:N,fedora- |all/smack=affected,jboss/an |all/smack=affected,jboss/an |ything=new,brms-6/smack=aff |ything=new,brms-6/smack=aff |ected |ected,brms-5/smack=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2013 |impact=moderate,public=2013 |0206,reported=20140430,sour |0206,reported=20140430,sour |ce=cvenew,cvss2=4.3/AV:N/AC |ce=cvenew,cvss2=4.3/AV:N/AC |:M/Au:N/C:N/I:P/A:N,fedora- |:M/Au:N/C:N/I:P/A:N,fedora- |all/smack=affected,jboss/an |all/smack=affected,jboss/an |ything=new,brms-6/smack=aff |ything=new,brms-6/smack=aff |ected,brms-5/smack=affected |ected,bpms-6/smack=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1093461 Depends On| |1093462
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2013 |impact=moderate,public=2013 |0206,reported=20140430,sour |0206,reported=20140430,sour |ce=cvenew,cvss2=4.3/AV:N/AC |ce=cvenew,cvss2=4.3/AV:N/AC |:M/Au:N/C:N/I:P/A:N,fedora- |:M/Au:N/C:N/I:P/A:N,fedora- |all/smack=affected,jboss/an |all/smack=affected,jboss/an |ything=new,brms-6/smack=aff |ything=new,brms-6/smack=aff |ected,bpms-6/smack=affected |ected,bpms-6/smack=affected | |,brms-5/smack=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1093469
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
David Jorm djorm@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |djorm@redhat.com Whiteboard|impact=moderate,public=2013 |impact=moderate,public=2013 |0206,reported=20140430,sour |0206,reported=20140430,sour |ce=cvenew,cvss2=4.3/AV:N/AC |ce=cvenew,cvss2=4.3/AV:N/AC |:M/Au:N/C:N/I:P/A:N,fedora- |:M/Au:N/C:N/I:P/A:N,fedora- |all/smack=affected,jboss/an |all/smack=affected,jboss/an |ything=new,brms-6/smack=aff |ything=new,brms-6/smack=aff |ected,bpms-6/smack=affected |ected,bpms-6/smack=affected |,brms-5/smack=affected |,brms-5/smack=wontfix
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
Arun Babu Neelicattu aneelica@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1114455
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
--- Comment #6 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in following products:
Via RHSA-2014:0819 https://rhn.redhat.com/errata/RHSA-2014-0819.html
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
--- Comment #7 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in following products:
Via RHSA-2014:0818 https://rhn.redhat.com/errata/RHSA-2014-0818.html
https://bugzilla.redhat.com/show_bug.cgi?id=1093273 Bug 1093273 depends on bug 1093274, which changed state.
Bug 1093274 Summary: CVE-2014-0363 smack: incorrect X.509 validation [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1093274
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
--- Comment #8 from Fedora Update System updates@fedoraproject.org --- smack-3.2.2-8.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
--- Comment #9 from Fedora Update System updates@fedoraproject.org --- smack-3.2.2-6.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |alazarot@redhat.com, | |brms-jira@redhat.com, | |etirelli@redhat.com, | |java-sig-commits@lists.fedo | |raproject.org, | |lpetrovi@redhat.com, | |mbaluch@redhat.com, | |mwinkler@redhat.com, | |nwallace@redhat.com, | |pavelp@redhat.com, | |rrajasek@redhat.com, | |rzhang@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1196295
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1232965
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
--- Doc Text *updated* by Chess Hazlett chazlett@redhat.com --- It was found that the ServerTrustManager in the Smack XMPP API did not verify basicConstraints and nameConstraints in X.509 certificate chains. A man-in-the-middle attacker could use this flaw to spoof servers and obtain sensitive information.
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
--- Comment #12 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Via RHSA-2015:1176 https://rhn.redhat.com/errata/RHSA-2015-1176.html
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
Ján Rusnačko jrusnack@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2013 |impact=moderate,public=2013 |0206,reported=20140430,sour |0206,reported=20140430,sour |ce=cvenew,cvss2=4.3/AV:N/AC |ce=cve,cvss2=4.3/AV:N/AC:M/ |:M/Au:N/C:N/I:P/A:N,fedora- |Au:N/C:N/I:P/A:N,fedora-all |all/smack=affected,jboss/an |/smack=affected,jboss/anyth |ything=new,brms-6/smack=aff |ing=new,brms-6/smack=affect |ected,bpms-6/smack=affected |ed,bpms-6/smack=affected,br |,brms-5/smack=wontfix,jboss |ms-5/smack=wontfix,jboss/fu |/fuse-6=affected,jboss/fuse |se-6=affected,jboss/fuse-es |-esq-7=wontfix |q-7=wontfix
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks|1196295 |
java-sig-commits@lists.fedoraproject.org