Bug 1128962 (CVE-2014-3504) - CVE-2014-3504 libserf: failure to properly handle a NUL character in the CommonName or SubjectAltNames fields
Summary: CVE-2014-3504 libserf: failure to properly handle a NUL character in the Comm...
Alias: CVE-2014-3504
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1128963 1128964 1128965
TreeView+ depends on / blocked
Reported: 2014-08-12 01:07 UTC by Murray McAllister
Modified: 2021-02-17 06:18 UTC (History)
3 users (show)

Fixed In Version: serf 1.3.7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2019-06-08 02:34:16 UTC

Attachments (Terms of Use)

Description Murray McAllister 2014-08-12 01:07:41 UTC
A flaw was found in the way Serf handled NUL characters in the CommonName and SubjectAltNames fields of X.509 certificates. An attacker able to get a carefully-crafted certificate signed by a trusted Certificate Authority could trick applications using Serf (such as Subversion on Fedora 20 and later, refer also to bug 1127063) into accepting it by mistake, allowing the attacker to perform a man-in-the-middle attack.

Serf versions 0.2.0 through 1.3.6 are vulnerable. It has been fixed in upstream version 1.3.7.

Upstream fix:


Upstream advisory:



Red Hat would like to thank the Subversion project for reporting this issue. Upstream acknowledges Ben Reser of WANdisco as the original reporter.

Comment 1 Murray McAllister 2014-08-12 01:09:43 UTC
Created libserf tracking bugs for this issue:

Affects: fedora-all [bug 1128963]
Affects: epel-6 [bug 1128964]
Affects: epel-7 [bug 1128965]

Comment 2 Murray McAllister 2014-08-12 23:44:59 UTC
> Upstream fix:
> https://code.google.com/p/serf/source/detail?r=2392

Ben Reser pointed out that the following is also needed:


Comment 3 Fedora Update System 2014-08-23 01:59:02 UTC
libserf-1.3.7-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Product Security DevOps Team 2019-06-08 02:34:16 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.

Note You need to log in before you can comment on or make changes to this bug.