| Summary: | openssl: X509_verify_cert() ignores EKU extension of trust anchors | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> | ||||||||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||||||
| Status: | CLOSED NOTABUG | QA Contact: | |||||||||||
| Severity: | medium | Docs Contact: | |||||||||||
| Priority: | medium | ||||||||||||
| Version: | unspecified | CC: | bbaranow, bmaxwell, cdewolf, cheimes, csutherl, dandread, darran.lofthouse, dknox, jason.greene, jawilson, jclere, jdoyle, lgao, mbabacek, myarboro, osoukup, pgier, psakar, pslavice, rsvoboda, security-response-team, tmraz, twalsh, vtunka, weli | ||||||||||
| Target Milestone: | --- | Keywords: | Security | ||||||||||
| Target Release: | --- | ||||||||||||
| Hardware: | All | ||||||||||||
| OS: | Linux | ||||||||||||
| Whiteboard: | |||||||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||||||
| Doc Text: | Story Points: | --- | |||||||||||
| Clone Of: | Environment: | ||||||||||||
| Last Closed: | 2017-03-24 06:45:46 UTC | Type: | --- | ||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||
| Documentation: | --- | CRM: | |||||||||||
| Verified Versions: | Category: | --- | |||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||
| Bug Depends On: | |||||||||||||
| Bug Blocks: | 1301692 | ||||||||||||
| Attachments: |
|
||||||||||||
|
Description
Adam Mariš
2016-01-25 16:52:53 UTC
Quoting maintainer: "This is a known behaviour, that is already planned to be addressed in OpenSSL 1.1.0. In fact the EKU is only checked for certificates from the peer, and not those from the trust store, so if your CAfile or CApath contains intermediate certificates that get used to build the chain, those won't be checked either." Created attachment 1127327 [details]
Proposed patch from upstream
Created attachment 1127328 [details]
Proposed patch from upstream
Created attachment 1127329 [details]
Master/mitaka patch
Proposed patch from upstream
//ignore "master/mitaka" name
Created attachment 1127330 [details]
Proposed patch from upstream
This patch was applied to upstream master branch to fix this issue: https://github.com/openssl/openssl/commit/33cc5dde478ba5ad79f8fd4acd8737f0e60e236e |