Bug 1019975

Summary:	socat: add TLS host name checks
Product:	Red Hat Enterprise Linux 7	Reporter:	Florian Weimer <fweimer>
Component:	socat	Assignee:	Paul Wouters <pwouters>
Status:	CLOSED CURRENTRELEASE	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7.0	CC:	gerhard, jaster, omoris
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	1.7.3.1-1	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-11-13 10:55:44 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1019961

Description Florian Weimer 2013-10-16 17:40:17 UTC

Currently, socat does not print an error message when certificate does not match the host name.  This is mitigated by the fact that the system CA certificate store is not used (bug 1019964).

Host name checking probably needs to be made optional, or the check could be overridden by specifying an explicit (non-CA) certificate or its SHA-256 hash.

Comment 4 Gerhard 2015-01-24 20:31:44 UTC

This has been fixed in socat version 1.7.3.0, Socat now checks the servername(s) in the certificates.

Comment 6 Paul Wouters 2018-11-13 10:55:44 UTC

This bug is addressed by ERRATA RHBA-2017:2049-03 socat bug fix update

https://errata.devel.redhat.com/advisory/26967