Bug 798533 – nss: Distrust MITM subCAs issued by TrustWave

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 798533 - nss: Distrust MITM subCAs issued by TrustWave

Summary:	nss: Distrust MITM subCAs issued by TrustWave

Status:	CLOSED ERRATA

Aliases:	None

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20120207,repor...
Keywords:	Security

Depends On:	798536 798537 798538 798539
Blocks:	784298 798556 827834
	Show dependency tree / graph

Reported:	2012-02-29 03:02 EST by Huzaifa S. Sidhpurwala
Modified:	2015-10-23 10:49 EDT (History)
CC List:	6 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2012-07-18 03:26:43 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2012:0973	normal	SHIPPED_LIVE	Moderate: nss, nss-util, and nspr security, bug fix, and enhancement update	2012-06-19 15:28:14 EDT
Red Hat Product Errata	RHSA-2012:1090	normal	SHIPPED_LIVE	Moderate: nss and nspr security, bug fix, and enhancement update	2012-07-17 18:15:16 EDT

Groups: None (edit)

Description Huzaifa S. Sidhpurwala 2012-02-29 03:02:41 EST

Trustwave issued a subordinate root certificate to a company, therefore enabling the company to issue unlimited SSL certificates for any domain/hostname:

http://blog.spiderlabs.com/2012/02/clarifying-the-trustwave-ca-policy-update.html

This violates the Mozilla CA Certificate Policy

Reference:
https://bugzilla.mozilla.org/show_bug.cgi?id=724929
https://bugzilla.mozilla.org/show_bug.cgi?id=728617

NSS 3.13.3 contains the patch to actively distrust the MITM subCAs issued by TrustWave.

Comment 3 errata-xmlrpc 2012-06-20 03:24:05 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:0973 https://rhn.redhat.com/errata/RHSA-2012-0973.html

Comment 6 Huzaifa S. Sidhpurwala 2012-06-22 01:12:19 EDT

This issue does not affect the version of nss as shipped with Fedora 16 and 17, since its already updated to 3.13.4

Comment 7 errata-xmlrpc 2012-07-17 14:18:37 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:1090 https://rhn.redhat.com/errata/RHSA-2012-1090.html

Comment 8 Huzaifa S. Sidhpurwala 2012-07-18 03:26:06 EDT

Statement:

(none)

Note You need to log in before you can comment on or make changes to this bug.