PT-2017-18269 · Nginx+2 · Nginx+2

Jirutka · Published 2017-04-27 · Updated 2019-10-03 · CVE-2017-8301

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions LibreSSL versions 2.5.1 through 2.5.3

Description The issue concerns a lack of TLS certificate verification in certain use cases. Specifically, if a user-provided verification callback returns 1, and the application relies on SSL get verify result for later verification checks, invalid certificates may be accepted. This has been demonstrated in the context of nginx.

Recommendations For LibreSSL versions 2.5.1 through 2.5.3, consider implementing additional verification checks beyond relying on SSL get verify result to ensure proper TLS certificate validation. As a temporary workaround, review and modify user-provided verification callbacks to return appropriate values for invalid certificates.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2017-1557

CVE-2017-8301

Affected Products

Alt Linux

Libressl

Nginx

References · 11

• https://github.com/libressl-portable/portable/issues/307 · Patch
• https://errata.altlinux.org/ALT-PU-2017-1557 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8301 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2017-8301 · Vendor Advisory
• https://trac.nginx.org/nginx/ticket/1257 · Patch
• https://osv.dev/vulnerability/CVE-2017-8301 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8301 · Security Note
• https://security.alpinelinux.org/vuln/CVE-2017-8301 · Note
• https://packages.altlinux.org/ru/vuln/CVE-2017-8301 · Note
• http://seclists.org/oss-sec/2017/q2/145 · Note
• http://securityfocus.com/bid/98076 · Note