|Summary:||CVE-2014-3504 libserf: failure to properly handle a NUL character in the CommonName or SubjectAltNames fields|
|Product:||[Other] Security Response||Reporter:||Murray McAllister <mmcallis>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||CLOSED UPSTREAM||QA Contact:|
|Version:||unspecified||CC:||carnil, i, jorton|
|Fixed In Version:||serf 1.3.7||Doc Type:||Bug Fix|
|Doc Text:||Story Points:||---|
|Last Closed:||2019-06-08 02:34:16 UTC||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Bug Depends On:||1128964, 1128963, 1128965|
Description Murray McAllister 2014-08-12 01:07:41 UTC
A flaw was found in the way Serf handled NUL characters in the CommonName and SubjectAltNames fields of X.509 certificates. An attacker able to get a carefully-crafted certificate signed by a trusted Certificate Authority could trick applications using Serf (such as Subversion on Fedora 20 and later, refer also to bug 1127063) into accepting it by mistake, allowing the attacker to perform a man-in-the-middle attack. Serf versions 0.2.0 through 1.3.6 are vulnerable. It has been fixed in upstream version 1.3.7. Upstream fix: https://code.google.com/p/serf/source/detail?r=2392 Upstream advisory: https://groups.google.com/forum/#!topic/serf-dev/NvgPoK6sFsc Acknowledgements: Red Hat would like to thank the Subversion project for reporting this issue. Upstream acknowledges Ben Reser of WANdisco as the original reporter.
Comment 1 Murray McAllister 2014-08-12 01:09:43 UTC
Created libserf tracking bugs for this issue: Affects: fedora-all [bug 1128963] Affects: epel-6 [bug 1128964] Affects: epel-7 [bug 1128965]
Comment 2 Murray McAllister 2014-08-12 23:44:59 UTC
> Upstream fix: > > https://code.google.com/p/serf/source/detail?r=2392 Ben Reser pointed out that the following is also needed: https://code.google.com/p/serf/source/detail?r=2398
Comment 3 Fedora Update System 2014-08-23 01:59:02 UTC
libserf-1.3.7-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Comment 5 Product Security DevOps Team 2019-06-08 02:34:16 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.