Bug 1853350 (CVE-2020-15719)

Summary: CVE-2020-15719 openldap: Certificate validation incorrectly matches name against CN-ID
Product: [Other] Security Response Reporter: Cedric Buissart <cbuissar>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: pkis, spichugi, vashirov
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-12-10 09:25:24 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1857290, 1857291    
Bug Blocks: 1790666    

Description Cedric Buissart 2020-07-02 12:56:51 UTC 
OpenLDAP library, libldap, fails to strictly follow RFC 6125 during certificate validation.

During certificate validation, a client matches the server's name against the Common Name identifier when other non-matching identifiers are present.
This is explicitly denied in RFC 6125 (section 6.4.4, Checking of Common Names) :

```
   As noted, a client MUST NOT seek a match for a reference identifier
   of CN-ID if the presented identifiers include a DNS-ID, SRV-ID,
   URI-ID, or any application-specific identifier types supported by the
   client.
```

This may help an attacker to force a client to consider a specially crafted certificate as valid, which could be used for a Person in the Middle attack.
Comment 1 Cedric Buissart 2020-07-02 12:56:55 UTC 
Acknowledgments:

Name: Jakub Hrozek, Christian Heimes
Comment 4 Cedric Buissart 2020-07-15 15:26:26 UTC 
In RHEL-8, this was fixed in openldap-2.4.46-10.el8
Comment 5 Cedric Buissart 2020-07-15 15:27:02 UTC 
External References:

https://bugzilla.redhat.com/show_bug.cgi?id=1740070
Comment 7 Cedric Buissart 2020-07-15 17:03:14 UTC 
related bugs :
original fix : https://bugzilla.redhat.com/show_bug.cgi?id=1740070 

regression fixes for the above : 
https://bugzilla.redhat.com/show_bug.cgi?id=1788572
https://bugzilla.redhat.com/show_bug.cgi?id=1814674