Bug 1128962 (CVE-2014-3504)

Summary: CVE-2014-3504 libserf: failure to properly handle a NUL character in the CommonName or SubjectAltNames fields
Product: [Other] Security Response Reporter: Murray McAllister <mmcallis>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED UPSTREAM QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: carnil, i, jorton
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: serf 1.3.7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 02:34:16 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1128963, 1128964, 1128965    
Bug Blocks:    

Description Murray McAllister 2014-08-12 01:07:41 UTC 
A flaw was found in the way Serf handled NUL characters in the CommonName and SubjectAltNames fields of X.509 certificates. An attacker able to get a carefully-crafted certificate signed by a trusted Certificate Authority could trick applications using Serf (such as Subversion on Fedora 20 and later, refer also to bug 1127063) into accepting it by mistake, allowing the attacker to perform a man-in-the-middle attack.

Serf versions 0.2.0 through 1.3.6 are vulnerable. It has been fixed in upstream version 1.3.7.

Upstream fix:

https://code.google.com/p/serf/source/detail?r=2392

Upstream advisory:

https://groups.google.com/forum/#!topic/serf-dev/NvgPoK6sFsc

Acknowledgements:

Red Hat would like to thank the Subversion project for reporting this issue. Upstream acknowledges Ben Reser of WANdisco as the original reporter.
Comment 1 Murray McAllister 2014-08-12 01:09:43 UTC 
Created libserf tracking bugs for this issue:

Affects: fedora-all [bug 1128963]
Affects: epel-6 [bug 1128964]
Affects: epel-7 [bug 1128965]
Comment 2 Murray McAllister 2014-08-12 23:44:59 UTC 
> Upstream fix:
> 
> https://code.google.com/p/serf/source/detail?r=2392

Ben Reser pointed out that the following is also needed:

https://code.google.com/p/serf/source/detail?r=2398
Comment 3 Fedora Update System 2014-08-23 01:59:02 UTC 
libserf-1.3.7-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Product Security DevOps Team 2019-06-08 02:34:16 UTC 
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.