Bug 873255 (CVE-2012-5786)

Summary:	CVE-2012-5786 cxf: Does not verify that the server hostname matches a domain name in the subject's CN or subjectAltName field of the x.509 certificate
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	djorm, mgoldman, pobara
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-11-06 07:27:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	873284
Bug Blocks:	873287

Description Jan Lieskovsky 2012-11-05 13:11:03 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2012-5786 to the following vulnerability:

The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF, possibly 2.6.0, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

References:
[1] http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
[2] https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html
[3] http://www.sigsac.org/ccs/CCS2012/techprogram.shtml

Comment 1 Jan Lieskovsky 2012-11-05 13:48:56 UTC

Created cxf tracking bugs for this issue

Affects: fedora-17 [bug 873284]

Comment 2 David Jorm 2012-11-06 07:27:32 UTC

Statement:

Not vulnerable. Apache CXF is shipped with several Red Hat products, but the wsdl_first_https sample is not included. Without this sample code, the flaw is not exposed.