Bug 448290 - (CVE-2008-2420) CVE-2008-2420 stunnel: incorrect CRL verification using OCSP protocol
CVE-2008-2420 stunnel: incorrect CRL verification using OCSP protocol
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
http://nvd.nist.gov/nvd.cfm?cvename=C...
source=secalert,reported=20080519,pub...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-05-25 09:49 EDT by Tomas Hoger
Modified: 2008-06-19 06:54 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-06-19 06:54:36 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Error report when applying stunnel update (124.08 KB, image/png)
2008-05-31 13:20 EDT, Raymond Hankins
no flags Details

  None (edit)
Description Tomas Hoger 2008-05-25 09:49:22 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-2420 to the following vulnerability:

The OCSP functionality in stunnel before 4.24 does not properly search
certificate revocation lists (CRL), which allows remote attackers to
bypass intended access restrictions by using revoked certificates.

References:
http://stunnel.mirt.net/pipermail/stunnel-announce/2008-May/000035.html
http://www.securityfocus.com/bid/29309
http://www.frsirt.com/english/advisories/2008/1569
http://secunia.com/advisories/30335
http://xforce.iss.net/xforce/xfdb/42528
Comment 1 Tomas Hoger 2008-05-25 09:53:16 EDT
This issue does not affect versions of stunnel as shipped in Red Hat Enterprise
Linux 2.1, 3, 4 and 5.  Support for OCSP protocol was only implemented in
version 4.16, all Red Hat Enterprise Linux versions ship older stunnel versions,
which do not support OCSP protocol.

http://stunnel.mirt.net/ChangeLog_sdf.html

Version 4.16, 2006.08.31, urgency: MEDIUM:

  * New features sponsored by Hewlett-Packard
     [ ... ]
     o OCSP support: ocsp = <URL>

Comment 2 Fedora Update System 2008-05-25 09:57:46 EDT
stunnel-4.24-0.fc7 has been submitted as an update for Fedora 7
Comment 3 Fedora Update System 2008-05-25 09:58:41 EDT
stunnel-4.24-0.fc8 has been submitted as an update for Fedora 8
Comment 4 Fedora Update System 2008-05-25 09:59:04 EDT
stunnel-4.24-1.fc9 has been submitted as an update for Fedora 9
Comment 5 Fedora Update System 2008-05-28 22:44:04 EDT
stunnel-4.24-1.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2008-05-28 22:47:19 EDT
stunnel-4.24-0.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2008-05-28 22:49:22 EDT
stunnel-4.24-0.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Raymond Hankins 2008-05-31 13:20:26 EDT
Created attachment 307284 [details]
Error report when applying stunnel update
Comment 9 Tomas Hoger 2008-05-31 15:50:01 EDT
(In reply to comment #8)
> Error report when applying stunnel update

Raymond, if you believe your problem is really caused by stunnel update, please
open a separate bug report against specific Fedora version with further details.
 Your screenshot does not provide enough information and there's no suggestion
there that the problem is caused by stunnel.

Thanks!

Note You need to log in before you can comment on or make changes to this bug.