Bug 1030572
| Summary: | perl-PlRPC: not secure across trust boundaries | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Florian Weimer <fweimer> | ||||||||||
| Component: | perl-PlRPC | Assignee: | perl-maint-list | ||||||||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Martin Kyral <mkyral> | ||||||||||
| Severity: | unspecified | Docs Contact: | |||||||||||
| Priority: | unspecified | ||||||||||||
| Version: | 7.0 | CC: | carnil, mkyral, ppisar | ||||||||||
| Target Milestone: | rc | Keywords: | Patch, Security, SecurityTracking | ||||||||||
| Target Release: | --- | ||||||||||||
| Hardware: | Unspecified | ||||||||||||
| OS: | Unspecified | ||||||||||||
| Whiteboard: | |||||||||||||
| Fixed In Version: | perl-PlRPC-0.2020-13.el7 | Doc Type: | Bug Fix | ||||||||||
| Doc Text: |
Cause:
Reading documentation.
Consequence:
Documentation does not warn on use of insecure Storable
Perl module and possible reply attacks.
Fix:
RPC::PlServer documentation has been amended with notice
about use of insecure Storable Perl module and
possibility of reply attack. An external authentication
mechanism is recommended now.
Result:
Documentation warns users about possible security flaws
in the PlRPC server.
|
Story Points: | --- | ||||||||||
| Clone Of: | Environment: | ||||||||||||
| Last Closed: | 2014-06-12 08:01:38 UTC | Type: | Bug | ||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||
| Documentation: | --- | CRM: | |||||||||||
| Verified Versions: | Category: | --- | |||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||
| Embargoed: | |||||||||||||
| Bug Depends On: | |||||||||||||
| Bug Blocks: | 1030547, 1051106, 1051108 | ||||||||||||
| Attachments: |
|
||||||||||||
|
Description
Florian Weimer
2013-11-14 17:23:00 UTC
Created attachment 825551 [details]
Proposed documentation fix
This has been posted to the upstream for a review.
(In reply to Petr Pisar from comment #4) > Created attachment 825551 [details] > Proposed documentation fix > > This has been posted to the upstream for a review. It seems that Storable deserialization is exposed prior to password-based authentication (see how AcceptUser is called in the server code). I think the warning should mention that. It's probably best to replace the entire "SECURITY" section with a clear warning that you absolutely have to use an external authentication mechanism. You are right. However the decryption is done before deserialization. So I guess if somebody wants to use a password for authentication, he will use encryption too. And that turns into two-step authentication as drafted in the SECURITY/Protection against untrusted users/Encryption paragraph: I recommend two phase encryption: The first phase is the login phase, where to use a host based key. As soon as the user has authorized, you should switch to a user based key. See the DBI::ProxyServer for an example. I will improve the text. Created attachment 825588 [details]
Proposed documentation fix 2
Updated documentation.
Created attachment 825589 [details]
Proposed documentation fix 2
Correct README conversion.
Created attachment 829254 [details]
Proposed documentation fix 2
I attached wrong patch. This one is correct.
Adding security keywords since this, or part of it anyways, has received a CVE. |