This service will be undergoing maintenance at 00:00 UTC, 2017-10-23 It is expected to last about 30 minutes
Bug 822639 - (CVE-2012-2130) CVE-2012-2130 polarssl: weak key generation in 0.99pre4 throught to 1.1.1
CVE-2012-2130 polarssl: weak key generation in 0.99pre4 throught to 1.1.1
Status: CLOSED CURRENTRELEASE
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20120423,repo...
: Security
Depends On: 822642
Blocks:
  Show dependency treegraph
 
Reported: 2012-05-17 13:04 EDT by Vincent Danen
Modified: 2012-05-19 12:11 EDT (History)
1 user (show)

See Also:
Fixed In Version: polarssl 1.1.2
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-05-19 12:11:56 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2012-05-17 13:04:15 EDT
From the upstream advisory [1]:

During code migration a bug was introduced in PolarSSL 0.99-pre4. As a result the generation of Diffie Hellman value X is weak on the client and server. Only a part of the value X is filled with random data, instead of the whole value. (Determined by the server Diffie Hellman parameters). In addition, MPI primes are only generated within a limited subspace of the full prime space. Again only a part of the prime is filled with random data, instead of the whole value.

Impact

When a weak X is generated the resulting Diffie Hellman key exchange is weaker. This makes it easier for an attacker to brute force the private value and thus the master secret. When the master secret is known, an attacker is able to modify and read all data in the secure channel.

MPI primes generated with mpi_gen_prime() are less secure. If rsa_gen_key() was used to generate RSA keys with PolarSSL, these keys are less secure as well. This only affects keys / primes generated within affected versions of PolarSSL, not keys generated in older versions or imported keys.

Resolution

PolarSSL version 1.1.2 contains a fix for the bug and generates full-size values of X and primes.

If you generated primes or RSA keys from within PolarSSL, re-generate and replace those primes / keys.

[1] http://polarssl.org/trac/wiki/SecurityAdvisory201201
Comment 1 Vincent Danen 2012-05-17 13:07:23 EDT
Created tracking bugs for polarssl:

fedora-17 [bug 822642]
Comment 2 Vincent Danen 2012-05-19 12:11:56 EDT
Fedora 17 currently has polarssl 1.1.3, so this is fixed.

Note You need to log in before you can comment on or make changes to this bug.