Bug 1695025 (CVE-2019-0215) - CVE-2019-0215 httpd: mod_ssl: access control bypass when using per-location client certification authentication
Summary: CVE-2019-0215 httpd: mod_ssl: access control bypass when using per-location c...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-0215
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1695046 1696090 1696091
Blocks: 1694984
TreeView+ depends on / blocked
 
Reported: 2019-04-02 10:17 UTC by Dhananjay Arunesh
Modified: 2021-02-16 22:09 UTC (History)
29 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Apache HTTP Server 2.4 (releases 2.4.37 and 2.4.38). A bug in mod_ssl, when using per-location client certificate verification with TLSv1.3, allowed a client supporting Post-Handshake Authentication to bypass configured access control restrictions. An attacker could perform various unauthorized actions after bypassing the restrictions. The highest threat from this vulnerability is to data confidentiality and integrity.
Clone Of:
Environment:
Last Closed: 2019-06-10 10:52:52 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:0980 0 None None None 2019-05-07 04:19:51 UTC

Description Dhananjay Arunesh 2019-04-02 10:17:57 UTC 
In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client supporting Post-Handshake Authentication to bypass configured access control restrictions.
Comment 1 Dhananjay Arunesh 2019-04-02 10:18:40 UTC 
External References:

https://httpd.apache.org/security/vulnerabilities_24.html
http://www.apache.org/dist/httpd/CHANGES_2.4
Comment 3 Dhananjay Arunesh 2019-04-02 11:33:04 UTC 
Created httpd tracking bugs for this issue:

Affects: fedora-all [bug 1695046]
Comment 5 Huzaifa S. Sidhpurwala 2019-04-04 07:04:05 UTC 
Patch is at: https://svn.apache.org/viewvc?view=revision&revision=1855917
Comment 8 Huzaifa S. Sidhpurwala 2019-04-15 05:31:14 UTC 
Statement:

This flaw can be exploited for httpd configurations where per-location client certificates are enabled and TLS 1.3 is used. 

The attacker can remotely exploit this httpd flaw (AV:N).  However the server had to be configured to use per-location client certificate and the attacker needs to have access to the authenticating client certificate (AC:H). No other significant privileges are required by the attacker (PR:L). The result of the attack is bypass of the configured access control restrictions (CI:H). This however does not affect the system beyond the web server itself (S:U).
Comment 9 errata-xmlrpc 2019-05-07 04:19:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:0980 https://access.redhat.com/errata/RHSA-2019:0980
Note You need to log in before you can comment on or make changes to this bug.