Bug 1026566 - (CVE-2013-4508) CVE-2013-4508 lighttpd: uses vulnerable cipher suites when SNI is used
CVE-2013-4508 lighttpd: uses vulnerable cipher suites when SNI is used
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20131104,repor...
: Security
Depends On: 1026567 1026568 1026569
Blocks:
  Show dependency treegraph
 
Reported: 2013-11-04 20:05 EST by Vincent Danen
Modified: 2014-06-13 15:35 EDT (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-06-13 15:35:52 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2013-11-04 20:05:34 EST
The following flaw was reported [1] in lighttpd.  Currently a patch is in progress [2] but is not yet complete.

Lighttpd supported SNI (Server Name Indication) since version 1.4.24, and a typical SNI configuration would look like:

    $HTTP["Host"] == "example.com" {
        ssl.pemfile = "/etc/ssl/certs/example.com.pem"
    }
    $SERVER["socket"] == ":443" {
        ssl.engine = "enable"
        ssl.pemfile = "/etc/ssl/certs/default.pem"
        ssl.cipher-list = "HIGH"
    }

This configuration is vulnerable as it will use ssl.cipher-list = "DEFAULT" for "example.com",  which contains vulnerable cipher suites.

[1] http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt
[2] http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.33_fix_ssl_sni.patch
Comment 2 Vincent Danen 2013-11-04 20:07:45 EST
Created lighttpd tracking bugs for this issue:

Affects: fedora-all [bug 1026567]
Affects: epel-all [bug 1026568]
Comment 3 Vincent Danen 2014-06-13 15:35:52 EDT
Fixed in:

lighttpd-1.4.34-1.el5.1
lighttpd-1.4.34-1.el6
lighttpd-1.4.34-3.fc19
lighttpd-1.4.34-3.fc20

Note You need to log in before you can comment on or make changes to this bug.