Bug 1301874 (CVE-2016-2047) - CVE-2016-2047 mysql: ssl-validate-cert incorrect hostname check
Summary: CVE-2016-2047 mysql: ssl-validate-cert incorrect hostname check
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-2047
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1301517 1301518 1301519 1304515 1304516 1329671 1329672 1330444 1330445 1342440 1342454
Blocks: 1329276
TreeView+ depends on / blocked
 
Reported: 2016-01-26 09:14 UTC by Andrej Nemec
Modified: 2021-02-17 04:26 UTC (History)
28 users (show)

Fixed In Version: mysql 5.5.48, mysql 5.6.29, mysql 5.7.11, mariadb 5.5.47, mariadb 10.1.10, mariadb 10.0.23
Doc Type: Bug Fix
Doc Text:
It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client.
Clone Of:
Environment:
Last Closed: 2016-11-21 01:47:06 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:0534 0 normal SHIPPED_LIVE Moderate: mariadb security and bug fix update 2016-04-01 01:50:48 UTC
Red Hat Product Errata RHSA-2016:0705 0 normal SHIPPED_LIVE Critical: rh-mysql56-mysql security update 2016-05-02 16:36:15 UTC
Red Hat Product Errata RHSA-2016:1132 0 normal SHIPPED_LIVE Important: rh-mariadb100-mariadb security update 2016-05-26 12:35:06 UTC
Red Hat Product Errata RHSA-2016:1480 0 normal SHIPPED_LIVE Important: mysql55-mysql security update 2016-07-25 12:25:32 UTC
Red Hat Product Errata RHSA-2016:1481 0 normal SHIPPED_LIVE Moderate: mariadb55-mariadb security update 2016-07-25 12:25:13 UTC

Description Andrej Nemec 2016-01-26 09:14:40 UTC
A vulnerability was found in a way mysql verifies certificates. Ssl_verify_server_cert() function parses the output of X509_NAME_oneline() to get the value of the /CN=... field. But if this string — "/CN=" — is present as a part of the value of some other field that might cause the output to be parsed incorrectly.

MariaDB upstream bug report:

https://mariadb.atlassian.net/browse/MDEV-9212

MariaDB upstream fix:

https://github.com/MariaDB/server/commit/f0d774d48416bb06063184380b684380ca005a41

External reference:

http://www.openwall.com/lists/oss-security/2016/01/26/3

Comment 2 errata-xmlrpc 2016-03-31 22:00:41 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:0534 https://rhn.redhat.com/errata/RHSA-2016-0534.html

Comment 3 Tomas Hoger 2016-04-22 14:02:13 UTC
MySQL was fixed as part of the April 2016 CPU:

http://www.oracle.com/technetwork/topics/security/cpuapr2016-2881694.html#AppendixMSQL
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html#AppendixMSQL

in versions 5.5.49, 5.6.30, and 5.7.12.

Comment 4 Tomas Hoger 2016-04-22 14:09:23 UTC
MySQL commit is:

https://github.com/mysql/mysql-server/commit/13380bf81f6bc20d39549f531f9acebdfb5a8c37

Tags on that commit show that the fix was actually applied in earlier versions - 5.5.48, 5.6.29, and 5.7.11.  It is only documented in release notes for 5.5.49, 5.6.30, and 5.7.12:

  Improper host name checking in X509 certificates could permit
  man-in-the-middle attacks. (Bug #22295186, Bug #22738607)

http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-49.html
http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-30.html
http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-12.html

The other bug id referenced by that release notes entry corresponds to the following fix applied in versions 5.5.49, 5.6.30, and 5.7.12:

https://github.com/mysql/mysql-server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69

That's a bug in embedded yaSSL library.  Red Hat builds of MySQL do not use embedded yaSSL and rather use system OpenSSL.

Comment 7 errata-xmlrpc 2016-05-02 12:42:52 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2016:0705 https://rhn.redhat.com/errata/RHSA-2016-0705.html

Comment 8 errata-xmlrpc 2016-05-26 08:36:42 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS

Via RHSA-2016:1132 https://access.redhat.com/errata/RHSA-2016:1132

Comment 11 errata-xmlrpc 2016-07-25 08:30:27 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2016:1481 https://rhn.redhat.com/errata/RHSA-2016-1481.html

Comment 12 errata-xmlrpc 2016-07-25 08:40:41 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2016:1480 https://rhn.redhat.com/errata/RHSA-2016-1480.html


Note You need to log in before you can comment on or make changes to this bug.