Red Hat Bugzilla – Full Text Bug Listing
|Summary:||CVE-2012-5821 lynx: Does not verify that the server's certificate is signed by a trusted certification authority|
|Product:||[Other] Security Response||Reporter:||Jan Lieskovsky <jlieskov>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||CLOSED NOTABUG||QA Contact:|
|Fixed In Version:||Doc Type:||Bug Fix|
|Doc Text:||Story Points:||---|
|Last Closed:||2012-11-06 11:13:02 EST||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Bug Depends On:||873278|
Description Jan Lieskovsky 2012-11-05 08:24:28 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-5821 to the following vulnerability: Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to improper use of a certain GnuTLS function. References:  http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf  https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html  http://www.sigsac.org/ccs/CCS2012/techprogram.shtml
Comment 1 Jan Lieskovsky 2012-11-05 08:44:53 EST
Created lynx tracking bugs for this issue Affects: fedora-all [bug 873278]
Comment 2 Kamil Dudka 2012-11-05 08:58:07 EST
We build lynx against OpenSSL, not GnuTLS. So this CVE does not apply, does it?
Comment 3 Jan Lieskovsky 2012-11-05 09:45:23 EST
(In reply to comment #2) > We build lynx against OpenSSL, not GnuTLS. So this CVE does not apply, does > it? In all supported versions? (me didn't check)
Comment 4 Kamil Dudka 2012-11-05 10:44:36 EST
Yes, lynx was built against OpenSSL in RHEL-3 already.
Comment 5 Jan Lieskovsky 2012-11-06 11:09:27 EST
This issue did not affect the versions of the lynx package, as shipped with Red Hat Enterprise Linux 5 and 6. -- This issue did not affect the versions of the lynx package, as shipped with Fedora release of 16 and 17.
Comment 6 Jan Lieskovsky 2012-11-06 11:13:02 EST
Statement: Not vulnerable. This issue did not affect the versions of lynx as shipped with Red Hat Enterprise Linux 5 and 6 as they were not build against GnuTLS.