Bug 1882841 (CVE-2020-26117) - CVE-2020-26117 tigervnc: certificate exceptions stored as authorities
Summary: CVE-2020-26117 tigervnc: certificate exceptions stored as authorities
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-26117
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1882848 1882849
Blocks: 1880937
TreeView+ depends on / blocked
 
Reported: 2020-09-25 21:44 UTC by Todd Cullum
Modified: 2021-05-18 15:01 UTC (History)
1 user (show)

Fixed In Version: tigervnc 1.11.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-05-18 14:35:31 UTC
Embargoed:


Attachments (Terms of Use)

Description Todd Cullum 2020-09-25 21:44:53 UTC
A security issue was discovered in tigervnc related how the viewers handle TLS certificate exceptions. Tigervnc before 1.11.0 stored the certificates as authorities, meaning that the owner of that certificate could impersonate any server it wanted after a client had added an exception. Tigervnc 1.11.0 handles this properly by only storing exceptions for specific hostname/certificate combinations, as done by HTTP user agents or SSH.

References:
https://github.com/TigerVNC/tigervnc/releases/tag/v1.11.0
https://github.com/TigerVNC/tigervnc/commit/f029745f63ac7d22fb91639b2cb5b3ab56134d6e
https://github.com/TigerVNC/tigervnc/commit/b30f10c681ec87720cff85d490f67098568a9cba
https://github.com/TigerVNC/tigervnc/commit/20dea801e747318525a5859fe4f37c52b05310cb
https://github.com/TigerVNC/tigervnc/commit/7399eab79a4365434d26494fa1628ce1eb91562b
https://bugzilla.opensuse.org/show_bug.cgi?id=1176733

Comment 2 Todd Cullum 2020-10-15 02:46:02 UTC
Mitigation:

This flaw can be mitigated by not making certificate exceptions in the affected versions of tigervnc, and therefore they will not be stored as authorities.

Comment 3 Product Security DevOps Team 2021-05-18 14:35:31 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-26117

Comment 4 errata-xmlrpc 2021-05-18 15:01:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1783 https://access.redhat.com/errata/RHSA-2021:1783


Note You need to log in before you can comment on or make changes to this bug.