Bug 1875549 (CVE-2020-14387) - CVE-2020-14387 rsync: rsync-ssl does not verify the hostname in the server certificate when using openssl
Summary: CVE-2020-14387 rsync: rsync-ssl does not verify the hostname in the server ce...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-14387
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1875550
Blocks: 1872966
TreeView+ depends on / blocked
 
Reported: 2020-09-03 18:19 UTC by Todd Cullum
Modified: 2021-02-16 19:22 UTC (History)
5 users (show)

Fixed In Version: rsync 3.2.4
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity.
Clone Of:
Environment:
Last Closed: 2020-09-03 19:17:51 UTC
Embargoed:

Attachments (Terms of Use)

Description Todd Cullum 2020-09-03 18:19:31 UTC 
In rsync > 3.2.0pre1, rsync-ssl does not verify the hostname in the server certificate in openssl mode, so a man-in-the-middle attacker with a valid certificate for another hostname could intercept connections.

Upstream patch: https://git.samba.org/?p=rsync.git;a=commit;h=c3f7414
Comment 1 Todd Cullum 2020-09-03 18:19:34 UTC 
Acknowledgments:

Name: Matt McCutchen
Comment 2 Todd Cullum 2020-09-03 18:20:43 UTC 
Created rsync tracking bugs for this issue:

Affects: fedora-32 [bug 1875550]
Comment 4 Product Security DevOps Team 2020-09-03 19:17:51 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-14387
Comment 5 Salvatore Bonaccorso 2020-09-04 12:55:25 UTC 
Hi

The information that the issue is fixed in 3.2.3: is this correct? Upstream commit c3f7414c450f ("rsync-ssl: Verify the hostname in the certificate when using openssl.") seems to not have been included in the v3.2.3 release.

Regards,
Salvatore
Comment 6 Todd Cullum 2020-09-04 16:09:33 UTC 
In reply to comment #5:
> The information that the issue is fixed in 3.2.3: is this correct? 

You're right, that's incorrect and occurred due to misinterpretation of a comment regarding a new  *package* release of 3.2.3 with a patch, and not the patch being in 3.2.3 itself. I've adjusted the metadata accordingly. Thanks for reporting that and apologize for confusion around this.
Comment 8 Eric Christensen 2020-09-08 14:58:57 UTC 
Mitigation:

This vulnerability can be mitigated by not using rsync-ssl in openssl mode.
Comment 9 Todd Cullum 2020-09-11 17:50:25 UTC 
To be fixed in the 3.2.4 release[1].

https://download.samba.org/pub/rsync/NEWS#3.2.4
Note You need to log in before you can comment on or make changes to this bug.