Bug 1081839 (CVE-2013-7449) - CVE-2013-7449 xchat/hexchat: does not verify the server hostname matches the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates
Summary: CVE-2013-7449 xchat/hexchat: does not verify the server hostname matches the ...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2013-7449
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1187322
Blocks: 1081840
TreeView+ depends on / blocked
 
Reported: 2014-03-28 04:30 UTC by Murray McAllister
Modified: 2023-05-12 17:53 UTC (History)
8 users (show)

Fixed In Version: hexchat 2.10.2
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-01-21 16:30:07 UTC
Embargoed:

Attachments (Terms of Use)

Description Murray McAllister 2014-03-28 04:30:24 UTC 
XChat did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name.
Comment 3 Murray McAllister 2014-03-30 23:37:26 UTC 
Acknowledgements:

Red Hat would like to thank Nicholas Bebout for reporting this issue.
Comment 13 Vincent Danen 2015-01-29 18:50:08 UTC 
This was fixed in hexchat this past November:

https://github.com/hexchat/hexchat/commit/c9b63f7f9be01692b03fa15275135a4910a7e02d

It was originally reported in April 2013:

https://github.com/hexchat/hexchat/issues/524

I'm not sure if that means it should have a 2013 CVE or a 2014 one.  I am requesting one on oss-security.

Also, upstream XChat is no longer in active development.
Comment 14 Vincent Danen 2015-01-29 18:56:23 UTC 
Created xchat tracking bugs for this issue:

Affects: fedora-all [bug 1187322]
Comment 15 Andrej Nemec 2016-04-07 07:27:24 UTC 
CVE assignment:

http://seclists.org/oss-sec/2016/q2/17
Note You need to log in before you can comment on or make changes to this bug.