Bug 1458057 (CVE-2017-7513)

Summary:	CVE-2017-7513 SAT 5: Failure to verify DB hostname against hostname in certificate in PostgreSQL through SSL configuration
Product:	[Other] Security Response	Reporter:	Kurt Seifried <kseifried>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bkearney, ggainey, jhutar, lhellebr, meissner, osoukup, security-response-team, taw, thomas, tkasparek, tlestach
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	It was found that Satellite 5 configured with SSL/TLS for the PostgreSQL backend failed to correctly validate X.509 server certificate host name fields. A man-in-the-middle attacker could use this flaw to spoof a PostgreSQL server using a specially crafted X.509 certificate.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-07-25 21:32:07 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1451656
Bug Blocks:	1452193

Description Kurt Seifried 2017-06-01 22:12:35 UTC

Lukáš Hellebrandt of Red Hat reports:

When running Satellite with external PostgreSQL backend, it is possible to secure the Satellite <-> DB server with SSL/TLS.
However, Satellite's Java part (contrary to backend), while it does verify the DB host's certificate against CA cert, does NOT verify the DB host's hostname against the one in its certificate.

Comment 3 Kurt Seifried 2017-07-25 21:31:30 UTC

Statement:

Red Hat Satellite 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.