Bug 2215465 (CVE-2023-33201) - CVE-2023-33201 bouncycastle: potential blind LDAP injection attack using a self-signed certificate
Summary: CVE-2023-33201 bouncycastle: potential blind LDAP injection attack using a s...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2023-33201
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2215467
TreeView+ depends on / blocked
 
Reported: 2023-06-16 06:09 UTC by Sandipan Roy
Modified: 2024-04-03 03:38 UTC (History)
90 users (show)

Fixed In Version: BouncyCastle 1.74
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.
Clone Of:
Environment:
Last Closed: 2023-06-30 00:17:45 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:3954 0 None None None 2023-06-29 20:08:46 UTC
Red Hat Product Errata RHSA-2023:5147 0 None None None 2023-09-13 15:40:20 UTC
Red Hat Product Errata RHSA-2023:5165 0 None None None 2023-09-14 09:51:53 UTC
Red Hat Product Errata RHSA-2023:5484 0 None None None 2023-10-05 20:21:47 UTC
Red Hat Product Errata RHSA-2023:5485 0 None None None 2023-10-05 20:22:17 UTC
Red Hat Product Errata RHSA-2023:5486 0 None None None 2023-10-05 20:23:30 UTC
Red Hat Product Errata RHSA-2023:5488 0 None None None 2023-10-05 20:18:37 UTC
Red Hat Product Errata RHSA-2023:7482 0 None None None 2023-11-24 16:53:23 UTC
Red Hat Product Errata RHSA-2023:7483 0 None None None 2023-11-24 16:53:12 UTC
Red Hat Product Errata RHSA-2023:7484 0 None None None 2023-11-24 16:52:58 UTC
Red Hat Product Errata RHSA-2023:7486 0 None None None 2023-11-24 16:53:37 UTC
Red Hat Product Errata RHSA-2023:7488 0 None None None 2023-11-24 16:57:58 UTC
Red Hat Product Errata RHSA-2023:7669 0 None None None 2023-12-06 22:07:32 UTC
Red Hat Product Errata RHSA-2023:7678 0 None None None 2023-12-06 23:30:48 UTC
Red Hat Product Errata RHSA-2024:0278 0 None None None 2024-01-17 13:23:21 UTC
Red Hat Product Errata RHSA-2024:1353 0 None None None 2024-03-18 09:48:30 UTC

Description Sandipan Roy 2023-06-16 06:09:01 UTC 
Issue affecting: BC 1.73 and earlier.

Fixed versions: BC 1.74

Platform affected: Java 4 and later.

Bouncy Castle provides the X509LDAPCertStoreSpi.java class which can be used in conjunction with the CertPath API for validating certificate paths. Pre-1.73 the implementation did not check the X.500 name of any certificate, subject, or issuer being passed in for LDAP wild cards, meaning the presence of a wild car may lead to Information Disclosure.

A potential attack would be to generate a self-signed certificate with a subject name that contains special characters, e.g: CN=Subject*)(objectclass=. This will be included into the filter and provides the attacker ability to specify additional attributes in the search query. This can be exploited as a blind LDAP injection: an attacker can enumerate valid attribute values using the boolean blind injection technique. The exploitation depends on the structure of the target LDAP directory, as well as what kind of errors are exposed to the user.

Changes to the X509LDAPCertStoreSpi.java class add the additional checking of any X.500 name used to correctly escape wild card characters.

https://github.com/bcgit/bc-java/wiki/CVE-2023-33201
Comment 4 errata-xmlrpc 2023-06-29 20:08:41 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 7.12

Via RHSA-2023:3954 https://access.redhat.com/errata/RHSA-2023:3954
Comment 5 Product Security DevOps Team 2023-06-30 00:17:38 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-33201
Comment 9 errata-xmlrpc 2023-09-13 15:40:16 UTC 
This issue has been addressed in the following products:

  RHINT Camel-Springboot 3.18.3.2

Via RHSA-2023:5147 https://access.redhat.com/errata/RHSA-2023:5147
Comment 10 errata-xmlrpc 2023-09-14 09:51:47 UTC 
This issue has been addressed in the following products:

  Red Hat AMQ Streams 2.5.0

Via RHSA-2023:5165 https://access.redhat.com/errata/RHSA-2023:5165
Comment 13 errata-xmlrpc 2023-10-05 20:18:32 UTC 
This issue has been addressed in the following products:

  EAP 7.4.13

Via RHSA-2023:5488 https://access.redhat.com/errata/RHSA-2023:5488
Comment 14 errata-xmlrpc 2023-10-05 20:21:42 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2023:5484 https://access.redhat.com/errata/RHSA-2023:5484
Comment 15 errata-xmlrpc 2023-10-05 20:22:12 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2023:5485 https://access.redhat.com/errata/RHSA-2023:5485
Comment 16 errata-xmlrpc 2023-10-05 20:23:24 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

Via RHSA-2023:5486 https://access.redhat.com/errata/RHSA-2023:5486
Comment 17 errata-xmlrpc 2023-11-24 16:52:44 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.6 for RHEL 9

Via RHSA-2023:7484 https://access.redhat.com/errata/RHSA-2023:7484
Comment 18 errata-xmlrpc 2023-11-24 16:53:07 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.6 for RHEL 8

Via RHSA-2023:7483 https://access.redhat.com/errata/RHSA-2023:7483
Comment 19 errata-xmlrpc 2023-11-24 16:53:19 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.6 for RHEL 7

Via RHSA-2023:7482 https://access.redhat.com/errata/RHSA-2023:7482
Comment 20 errata-xmlrpc 2023-11-24 16:53:33 UTC 
This issue has been addressed in the following products:

  RHEL-8 based Middleware Containers

Via RHSA-2023:7486 https://access.redhat.com/errata/RHSA-2023:7486
Comment 21 errata-xmlrpc 2023-11-24 16:57:53 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On

Via RHSA-2023:7488 https://access.redhat.com/errata/RHSA-2023:7488
Comment 22 errata-xmlrpc 2023-12-06 22:07:27 UTC 
This issue has been addressed in the following products:

  Cryostat 2 on RHEL 8

Via RHSA-2023:7669 https://access.redhat.com/errata/RHSA-2023:7669
Comment 23 errata-xmlrpc 2023-12-06 23:30:43 UTC 
This issue has been addressed in the following products:

  Red Hat AMQ Streams 2.6.0

Via RHSA-2023:7678 https://access.redhat.com/errata/RHSA-2023:7678
Comment 25 errata-xmlrpc 2024-01-17 13:23:17 UTC 
This issue has been addressed in the following products:

  AMQ Broker 7.11.5

Via RHSA-2024:0278 https://access.redhat.com/errata/RHSA-2024:0278
Comment 26 errata-xmlrpc 2024-03-18 09:48:25 UTC 
This issue has been addressed in the following products:

  RHPAM 7.13.5 async

Via RHSA-2024:1353 https://access.redhat.com/errata/RHSA-2024:1353
Comment 27 Paramvir jindal 2024-04-03 03:38:23 UTC 
Marking EAP-8 as not affected because EAP 8 GA was released with the fixed version of netty.
Note You need to log in before you can comment on or make changes to this bug.