Bug 832729

Summary:	gnutls_certificate_get_issuer() returns invalid result because does lookups by name alone.
Product:	[Fedora] Fedora	Reporter:	David Woodhouse <dwmw2>
Component:	gnutls	Assignee:	Tomas Mraz <tmraz>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	17	CC:	h.peter.anvin, jorton, tmraz
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-11-21 03:57:15 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description David Woodhouse 2012-06-16 21:29:06 UTC

This means that anything else which relies on finding issuers, like certificate validation, can also fail. And when client software wants to include a full trust chain on the wire along with a client certificate, it can't. Which leads to authentication failures.

My employer uses intermediate CAs which they reissue every three years, with the *same* name. Thus there are about three CAs with the name 'Intel_Intranet_Basic_Issuing_CA_1B'. If you are trying to verify a certificate issued by one of those, and GnuTLS picks the wrong CA based on the name alone, it's going to find that the signature doesn't validate.

This is fixed in GnuTLS 3.0.19.

Comment 1 David Woodhouse 2012-06-16 21:29:39 UTC

Hm, I think I lie; it's fixed in 3.0.20 not 3.0.19.

Comment 2 David Woodhouse 2012-06-18 10:24:24 UTC

Note that this has not been fixed in any LGPLv2.1-licensed version of GnuTLS upstream; the fix is under LGPLv3. If you backport it, you probably need to ask the maintainer for permission or (less sanely) license your entire package under LGPLv3.

Comment 3 Tomas Mraz 2012-06-18 12:55:34 UTC

(In reply to comment #2)
> Note that this has not been fixed in any LGPLv2.1-licensed version of GnuTLS
> upstream; the fix is under LGPLv3. If you backport it, you probably need to
> ask the maintainer for permission or (less sanely) license your entire
> package under LGPLv3.

Untrue - it was released in 2.12.20 where the library is still LGPLv2.1.

But thanks for this heads up - one more thing to remember to change in the .spec once we will move to 3.0 branch.

Comment 4 David Woodhouse 2012-06-18 14:33:52 UTC

Ah right. Nikos has pushed that fix and released 2.12.20 since I identified it. My local git tree still has the gnutls_2_12_x branch at the 2.12.19 release.
No problem then (not that asking for permission would likely have been a problem either).

Comment 5 H. Peter Anvin, Intel 2012-11-05 10:07:19 UTC

I just ran into this problem... it is definitely a security hazard.

Any chance this fix could be pushed?

Comment 6 Fedora Update System 2012-11-05 14:14:31 UTC

gnutls-2.12.20-4.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/gnutls-2.12.20-4.fc17

Comment 7 Fedora Update System 2012-11-05 14:14:55 UTC

gnutls-2.12.14-4.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/gnutls-2.12.14-4.fc16

Comment 8 Fedora Update System 2012-11-06 07:50:56 UTC

Package gnutls-2.12.20-4.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing gnutls-2.12.20-4.fc17'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-17641/gnutls-2.12.20-4.fc17
then log in and leave karma (feedback).

Comment 9 H. Peter Anvin, Intel 2012-11-08 12:25:51 UTC

Tested, and works as it should.

Comment 10 Fedora Update System 2012-11-21 03:57:17 UTC

gnutls-2.12.14-4.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2012-11-21 03:59:09 UTC

gnutls-2.12.20-4.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.