PT-2017-18269 · Nginx+2 · Nginx+2

Jirutka · Publicado 2017-04-27 · Atualizado 2019-10-03 · CVE-2017-8301

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions LibreSSL versions 2.5.1 through 2.5.3

Description The issue concerns a lack of TLS certificate verification in certain use cases. Specifically, if a user-provided verification callback returns 1, and the application relies on SSL get verify result for later verification checks, invalid certificates may be accepted. This has been demonstrated in the context of nginx.

Recommendations For LibreSSL versions 2.5.1 through 2.5.3, consider implementing additional verification checks beyond relying on SSL get verify result to ensure proper TLS certificate validation. As a temporary workaround, review and modify user-provided verification callbacks to return appropriate values for invalid certificates.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

ALT-PU-2017-1557

CVE-2017-8301

Produtos afetados

Alt Linux

Libressl

Nginx

Referências · 11

• https://github.com/libressl-portable/portable/issues/307 · Correção
• https://errata.altlinux.org/ALT-PU-2017-1557 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8301 · Nota de Segurança
• https://osv.dev/vulnerability/ALPINE-CVE-2017-8301 · Aviso do Fabricante
• https://security.alpinelinux.org/vuln/CVE-2017-8301 · Nota
• https://packages.altlinux.org/ru/vuln/CVE-2017-8301 · Nota
• http://seclists.org/oss-sec/2017/q2/145 · Nota
• https://trac.nginx.org/nginx/ticket/1257 · Correção
• https://osv.dev/vulnerability/CVE-2017-8301 · Aviso do Fabricante
• http://securityfocus.com/bid/98076 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-8301 · Nota de Segurança