<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 09/07/2015 15:10, OpenSSL wrote:<br>
</div>
<blockquote cite="mid:20150709131024.GA9863@openssl.org" type="cite">
<pre wrap="">-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
OpenSSL Security Advisory [9 Jul 2015]
=======================================
Alternative chains certificate forgery (CVE-2015-1793)
======================================================
Severity: High
During certificate verification, OpenSSL (starting from version 1.0.1n and
1.0.2b) will attempt to find an alternative certificate chain if the first
attempt to build such a chain fails. An error in the implementation of this
logic can mean that an attacker could cause certain checks on untrusted
certificates to be bypassed, such as the CA flag, enabling them to use a valid
leaf certificate to act as a CA and "issue" an invalid certificate.</pre>
</blockquote>
<tt>Why was this introduced in a patch release? I thought </tt><tt><br>
</tt><tt>i</tt><tt>mproved chain building was a new feature, and
thus </tt><tt><br>
</tt><tt>delineated by a library version number such as 1.0.2</tt><tt>
or </tt><tt><br>
</tt><tt>1.0.3</tt><tt> . In fact, I thought that was the reason
we all <br>
had to wait ages before this long standing shortcoming <br>
was fixed.</tt><br>
<blockquote cite="mid:20150709131024.GA9863@openssl.org" type="cite">
<pre wrap="">
This issue will impact any application that verifies certificates including
SSL/TLS/DTLS clients and SSL/TLS/DTLS servers using client authentication.</pre>
</blockquote>
<tt>Does this vulnerability also affect applications that <br>
use OpenSSL or the openssl command line to handle S/MIME <br>
or other CMS messages?<br>
<br>
For example, the mail client mutt handles S/MIME by <br>
invoking the openssl command line via macros in the <br>
default configuration file.<br>
</tt><br>
<tt>P.S.</tt><tt><br>
</tt><tt><br>
</tt><tt>Sorry for first trying to send to -announce, MUA must <br>
have ignored the Reply-To</tt><tt>.<br>
</tt><tt> </tt>
<pre class="moz-signature" cols="72">Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. <a class="moz-txt-link-freetext" href="http://www.wisemo.com">http://www.wisemo.com</a>
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded </pre>
</body>
</html>