Bug 873262 (CVE-2012-5821)

Summary: CVE-2012-5821 lynx: Does not verify that the server's certificate is signed by a trusted certification authority
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: kdudka
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20121016,reported=20121104,source=cve,cvss2=4.3/AV:N/AC:M/Au:N/C:N/I:P/A:N,rhel-5/lynx=notaffected,rhel-6/lynx=notaffected,fedora-all/lynx=notaffected
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-11-06 11:13:02 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 873278    
Bug Blocks: 873282    

Description Jan Lieskovsky 2012-11-05 08:24:28 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-5821 to the following vulnerability:

Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to improper use of a certain GnuTLS function.

References:
[1] http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
[2] https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html
[3] http://www.sigsac.org/ccs/CCS2012/techprogram.shtml
Comment 1 Jan Lieskovsky 2012-11-05 08:44:53 EST
Created lynx tracking bugs for this issue

Affects: fedora-all [bug 873278]
Comment 2 Kamil Dudka 2012-11-05 08:58:07 EST
We build lynx against OpenSSL, not GnuTLS.  So this CVE does not apply, does it?
Comment 3 Jan Lieskovsky 2012-11-05 09:45:23 EST
(In reply to comment #2)
> We build lynx against OpenSSL, not GnuTLS.  So this CVE does not apply, does
> it?

In all supported versions? (me didn't check)
Comment 4 Kamil Dudka 2012-11-05 10:44:36 EST
Yes, lynx was built against OpenSSL in RHEL-3 already.
Comment 5 Jan Lieskovsky 2012-11-06 11:09:27 EST
This issue did not affect the versions of the lynx package, as shipped with Red Hat Enterprise Linux 5 and 6.

--

This issue did not affect the versions of the lynx package, as shipped with Fedora release of 16 and 17.
Comment 6 Jan Lieskovsky 2012-11-06 11:13:02 EST
Statement:

Not vulnerable. This issue did not affect the versions of lynx as shipped with Red Hat Enterprise Linux 5 and 6 as they were not build against GnuTLS.