Bug 1458057 – CVE-2017-7513 SAT 5: Failure to verify DB hostname against hostname in certificate in PostgreSQL through SSL configuration

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1458057 - (CVE-2017-7513) CVE-2017-7513 SAT 5: Failure to verify DB hostname against hostname in certificate in PostgreSQL through SSL configuration

Summary:	CVE-2017-7513 SAT 5: Failure to verify DB hostname against hostname in certif...

Status:	CLOSED WONTFIX

Aliases:	CVE-2017-7513

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20170725,repor...
Keywords:	Security

Depends On:	1451656
Blocks:	1452193
	Show dependency tree / graph

Reported:	2017-06-01 18:12 EDT by Kurt Seifried
Modified:	2017-07-25 17:32 EDT (History)
CC List:	10 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:	It was found that Satellite 5 configured with SSL/TLS for the PostgreSQL backend failed to correctly validate X.509 server certificate host name fields. A man-in-the-middle attacker could use this flaw to spoof a PostgreSQL server using a specially crafted X.509 certificate.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-07-25 17:32:07 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Kurt Seifried 2017-06-01 18:12:35 EDT

Lukáš Hellebrandt of Red Hat reports:

When running Satellite with external PostgreSQL backend, it is possible to secure the Satellite <-> DB server with SSL/TLS.
However, Satellite's Java part (contrary to backend), while it does verify the DB host's certificate against CA cert, does NOT verify the DB host's hostname against the one in its certificate.

Comment 1 Kurt Seifried 2017-06-01 18:26:56 EDT

Acknowledgements:

Lukáš Hellebrandt (Red Hat)

Comment 3 Kurt Seifried 2017-07-25 17:31:30 EDT

Statement:

Red Hat Satellite 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Note You need to log in before you can comment on or make changes to this bug.