Bug 873262 - (CVE-2012-5821) CVE-2012-5821 lynx: Does not verify that the server's certificate is signed by a trusted certification authority
CVE-2012-5821 lynx: Does not verify that the server's certificate is signed b...
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20121016,repor...
: Security
Depends On: 873278
Blocks: 873282
  Show dependency treegraph
 
Reported: 2012-11-05 08:24 EST by Jan Lieskovsky
Modified: 2012-11-06 11:13 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-11-06 11:13:02 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2012-11-05 08:24:28 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-5821 to the following vulnerability:

Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to improper use of a certain GnuTLS function.

References:
[1] http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
[2] https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html
[3] http://www.sigsac.org/ccs/CCS2012/techprogram.shtml
Comment 1 Jan Lieskovsky 2012-11-05 08:44:53 EST
Created lynx tracking bugs for this issue

Affects: fedora-all [bug 873278]
Comment 2 Kamil Dudka 2012-11-05 08:58:07 EST
We build lynx against OpenSSL, not GnuTLS.  So this CVE does not apply, does it?
Comment 3 Jan Lieskovsky 2012-11-05 09:45:23 EST
(In reply to comment #2)
> We build lynx against OpenSSL, not GnuTLS.  So this CVE does not apply, does
> it?

In all supported versions? (me didn't check)
Comment 4 Kamil Dudka 2012-11-05 10:44:36 EST
Yes, lynx was built against OpenSSL in RHEL-3 already.
Comment 5 Jan Lieskovsky 2012-11-06 11:09:27 EST
This issue did not affect the versions of the lynx package, as shipped with Red Hat Enterprise Linux 5 and 6.

--

This issue did not affect the versions of the lynx package, as shipped with Fedora release of 16 and 17.
Comment 6 Jan Lieskovsky 2012-11-06 11:13:02 EST
Statement:

Not vulnerable. This issue did not affect the versions of lynx as shipped with Red Hat Enterprise Linux 5 and 6 as they were not build against GnuTLS.

Note You need to log in before you can comment on or make changes to this bug.