PT-2018-18749 · Openssl+1 · Libressl+1

Christian Heimes · Published 2018-03-24 · Updated 2024-06-15 · CVE-2018-8970

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions LibreSSL versions 2.7.0

Description The issue arises from the int x509 param set hosts function in lib/libcrypto/x509/x509 vpm.c, which fails to handle a specific special case of a zero name length. This oversight leads to the silent omission of hostname verification, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Recommendations For LibreSSL version 2.7.0, update to version 2.7.1 to resolve the issue.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2018-8970

OPENSUSE-SU-2018_2597-1

OPENSUSE-SU-2024:10985-1

Affected Products

Libressl

Suse

References · 15

• https://github.com/libressl-portable/openbsd/commit/0654414afcce51a16d35d05060190a3ec4618d42 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:10985-1 · Vendor Advisory
• https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.7.1-relnotes.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8970 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8970 · Security Note
• https://bugzilla.suse.com/1065363 · Note
• https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.8.0-relnotes · Note
• https://bugzilla.suse.com/1086778 · Note
• https://bugzilla.suse.com/1097779 · Note
• https://boringssl.googlesource.com/boringssl/+/e759a9cd84198613199259dbed401f4951747cff · Note
• https://suse.com/security/cve/CVE-2018-12434 · Note
• https://suse.com/security/cve/CVE-2018-8970.html · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/LWLR23DQB2GF3VO4LFK3XSEFLVVRTEJ4 · Note
• https://suse.com/security/cve/CVE-2018-12434.html · Note
• https://suse.com/security/cve/CVE-2018-8970 · Note