Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE request: radsecproxy incorrect x.509 certificate validation
From: Kurt Seifried <kseifried () redhat com>
Date: Wed, 17 Oct 2012 12:42:53 -0600

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/17/2012 11:48 AM, Raphael Geissert wrote:
Hi,

Ralf Paffrath discovered that radsecproxy may incorrectly accept a
client certificate if the certificates chain was validated with the
CA settings of one configuration block but the other certificate
constraints failed, and the certificate constraints of another
configuration block passed (ignoring this other config block's CA
settings.)

This issue has been fixed in version 1.6.1. However, it introduces
a minor regression as it ignores some configuration blocks (see the
references for further details.)

Could a CVE id be assigned?

Thanks in advance.

References: https://project.nordu.net/browse/RADSECPROXY-43 
https://postlister.uninett.no/sympa/arc/radsecproxy/2012-09/msg00001.html


https://postlister.uninett.no/sympa/arc/radsecproxy/2012-09/msg00006.html


Please use CVE-2012-4523 for this issue.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/

iQIcBAEBAgAGBQJQfvwtAAoJEBYNRVNeJnmT2BAP/2A5V4oLMJf8oxfmrjwjHjf5
2hlcIYZtn0ScmAMfCkKIyxW99qftyV82yp21jSkdTER0LA+U8go40p6YhUAfSxDQ
yaaIemJo0vKVLVNksa9PosrugFEoqF2P7olVKRtRyvuhLTizih4jwg04Mxq7s6S5
Y/8KOCWLrdyJsYTrNFpfDfCxOLiBgVNdR6pxu5t8BMQ1UrW2INqcvCHrfM9m6hKG
3WI2UUDUJZoEGsZwARYPQEoxpq0/rRyyos7YrofnATSaf0m/xI7zUCi585KxYigd
n4mz9h5A9NSzm0p4B4AAOeBxR2T7J8BPHDEzIcVibYbm6GX9nxINcgr4Us6KWKkV
NZvkAYXlQhXPliOQrwhS9Wan6YgwBLc/zQdLBghO8dA/pdpBAOQXyUWz2nVM2KjQ
n30jsM+Dgby+74WuaTAKjzuW7ooaE4Et4//DxFIqJYMk4kYAJJrrH7Wl0Rku4agb
Vo37rM0aZzzu1udPciuEdwLckvnNRl9ZypYRxG2TQGWOxbKPflMfNUmxZB6f3pp9
3gXUI2nsysXJL9W3BEZ95BVJLqzhVwDygLP9Ikwd1e+Lse+yGD7HD85x3gT4obuk
eyhl+7YAFSbxbp7UrjK1/3c2WO/Ze0rh3tRd2zo/P2N1/U/qgYrUMIUs6bP3b8nS
nb0+JTm68XmEwEu02T+A
=BwI6
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]