Bug 1523504 (CVE-2017-3737)

Summary:	CVE-2017-3737 openssl: Read/write after SSL object in error state
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	apmukher, bmaxwell, bmcclain, casmith, cdewolf, cfergeau, chazlett, christian.m.carawan.civ, csutherl, darran.lofthouse, dblechte, dcox, dimitris, dosoudil, eedri, erik-fedora, extras-orphan, fgavrilo, fkrska, gzaronik, jawilson, jclere, jondruse, jorton, jshepherd, kbost, ktietz, lersek, lgao, lsurette, marcandre.lureau, mbabacek, mgoldboi, michal.skrivanek, mis, mpoole, mturk, myarboro, pgier, pjurak, ppalaga, psakar, pslavice, ravpatil, rh-spice-bugs, rjones, rnetuka, rstancel, rsvoboda, sherold, slawomir, srevivo, tmraz, twalsh, vtunka, weli, ykaul, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	openssl 1.0.2n	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:32:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1523511, 1523513, 1524795, 1524796, 1525029, 1525347, 1527300, 1544443
Bug Blocks:	1523515

Description Andrej Nemec 2017-12-08 07:36:43 UTC

OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state"
mechanism. The intent was that if a fatal error occurred during a handshake then
OpenSSL would move into the error state and would immediately fail if you
attempted to continue the handshake. This works as designed for the explicit
handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()),
however due to a bug it does not work correctly if SSL_read() or SSL_write() is
called directly. In that scenario, if the handshake fails then a fatal error
will be returned in the initial function call. If SSL_read()/SSL_write() is
subsequently called by the application for the same SSL object then it will
succeed and the data is passed without being decrypted/encrypted directly from
the SSL/TLS record layer.

In order to exploit this issue an application bug would have to be present that
resulted in a call to SSL_read()/SSL_write() being issued after having already
received a fatal error.

External References:

https://www.openssl.org/news/secadv/20171207.txt

Comment 1 Andrej Nemec 2017-12-08 07:41:44 UTC

Created mingw-openssl tracking bugs for this issue:

Affects: epel-7 [bug 1523513]
Affects: fedora-all [bug 1523511]


Created openssl tracking bugs for this issue:

Affects: fedora-all [bug 1523512]

Comment 7 Ravindra Patil 2018-01-15 20:49:07 UTC

Any ETA for release of fix for openssl ?

Comment 9 mis 2018-02-20 18:32:13 UTC

Any ETA on this... Failing PCI Scans because of this...

Comment 10 Doug Cox 2018-02-26 19:46:13 UTC

I'm also have PCI scans fail and the Treasurer is not happy!  Any ETA would be helpful.  Thanks

Comment 13 mis 2018-03-02 14:40:59 UTC

Can anyone from Redhat provide feedback on where this issue sits?

An ETA has been requested multiple times, with no response.

Feedback, with an ETA would be extremely helpful.

Comment 14 Sam Fowler 2018-03-15 07:20:36 UTC

Upstream Patch:

https://github.com/openssl/openssl/commit/898fb884b706aaeb283de4812340bb0bde8476dc

Comment 15 mis 2018-04-03 12:59:40 UTC

It's now been almost 4 months since this bug was identified, and there is still no updated package, and no ETA on an updated package.

What's the problem here?

Can we all get an ETA on this update?

Comment 16 Calvin Smith 2018-04-10 00:18:58 UTC

Per https://bugzilla.redhat.com/show_bug.cgi?id=1544443, this is fixed in RHEL 7.5

Comment 17 errata-xmlrpc 2018-04-10 08:39:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:0998 https://access.redhat.com/errata/RHSA-2018:0998

Comment 18 errata-xmlrpc 2018-07-12 16:05:55 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2018:2187 https://access.redhat.com/errata/RHSA-2018:2187

Comment 19 errata-xmlrpc 2018-07-12 16:15:39 UTC

This issue has been addressed in the following products:

  JBoss Core Services on RHEL 6

Via RHSA-2018:2186 https://access.redhat.com/errata/RHSA-2018:2186

Comment 20 errata-xmlrpc 2018-07-12 16:18:00 UTC

This issue has been addressed in the following products:

  JBoss Core Services on RHEL 7

Via RHSA-2018:2185 https://access.redhat.com/errata/RHSA-2018:2185