Bug 1222816 (CVE-2014-9720)
Summary: | CVE-2014-9720 python-tornado: XSRF cookie allows side-channel attack against TLS (BREACH) | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Vasyl Kaigorodov <vkaigoro> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED WONTFIX | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | jrusnack, mhroncok, orion, python-maint, python-sig, tomspur |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | python-tornado 3.2.2 | Doc Type: | Bug Fix |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2015-08-12 08:23:14 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1222819, 1222820 | ||
Bug Blocks: | 1222818 |
Description
Vasyl Kaigorodov
2015-05-19 08:53:05 UTC
Created python-tornado tracking bugs for this issue: Affects: fedora-all [bug 1222819] Affects: epel-all [bug 1222820] python-tornado-3.2.2-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report. python-tornado-3.2.2-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report. Analysis: BREACH attack misuses the interaction between compression and encryption to extract secrets from encrypted message. If attacker can control part of the message being encrypted, which contains a secret, he could observe lengths of encrypted messages to infer which strings were present in the message before compression, with the idea that message containing multiple occurrences of some substring should be compressed more efficiently. Given the scenario where client sends a HHTP request M to the server containing secret S (CSRF token) and * attacker can inject strings into message M *before* S appears * attacker can observe length of the encrypted request then attacker can start iterating over all possible strings P and constructing M=a + P + b + S + c, where a,b,c are any data, and observing the length of the compressed and encrypted message. If the secret S contains string P, compression algorithm will output shorter message, than in the case S does not contain P. By iterating over all P, attacker can infer from the length of compressed and encrypted requests which string P are contained in S, thus revealing the secret. The fix for this flaw masks secret S (CSRF) token by XORing it with random string. This prevents BREACH attack, because every request now contain string S'=S xor R, which is different for every message, instead of a fixed secret S. External references: http://www.tornadoweb.org/en/stable/releases/v3.2.2.html |