A flaw was found in the way Serf handled NUL characters in the CommonName and SubjectAltNames fields of X.509 certificates. An attacker able to get a carefully-crafted certificate signed by a trusted Certificate Authority could trick applications using Serf (such as Subversion on Fedora 20 and later, refer also to bug 1127063) into accepting it by mistake, allowing the attacker to perform a man-in-the-middle attack. Serf versions 0.2.0 through 1.3.6 are vulnerable. It has been fixed in upstream version 1.3.7. Upstream fix: https://code.google.com/p/serf/source/detail?r=2392 Upstream advisory: https://groups.google.com/forum/#!topic/serf-dev/NvgPoK6sFsc Acknowledgements: Red Hat would like to thank the Subversion project for reporting this issue. Upstream acknowledges Ben Reser of WANdisco as the original reporter.
Created libserf tracking bugs for this issue: Affects: fedora-all [bug 1128963] Affects: epel-6 [bug 1128964] Affects: epel-7 [bug 1128965]
> Upstream fix: > > https://code.google.com/p/serf/source/detail?r=2392 Ben Reser pointed out that the following is also needed: https://code.google.com/p/serf/source/detail?r=2398
libserf-1.3.7-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.