Bug 1043398 (CVE-2017-7507)

Summary:	VUL-1: CVE-2017-7507: gnutls: Crash upon receiving well-formed status_request extension
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Victor Pereira <vpereira>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Minor
Priority:	P3 - Medium	CC:	astieger, smash_bz, vcizek
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/186441/
Whiteboard:	CVSSv3:RedHat:CVE-2017-7507:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) CVSSv3:NVD:CVE-2017-7507:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) CVSSv2:NVD:CVE-2017-7507:5.0:(AV:N/AC:L/Au:N/C:N/I:N/A:P)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Victor Pereira 2017-06-08 13:20:10 UTC

rh#1454621

It was found that GnuTLS would crash when receiving a client hello message with status_request extension that has a non-empty responder_id_list.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1454621
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7507

Comment 1 Victor Pereira 2017-06-08 13:21:00 UTC

upstream advisory: https://www.gnutls.org/security.html#GNUTLS-SA-2017-4

Comment 2 Andreas Stieger 2017-06-08 15:27:29 UTC

Code:
https://gitlab.com/gnutls/gnutls/commit/4c4d35264fada08b6536425c051fb8e0b05ee86b
ext/status_request: ensure response IDs are properly deinitialized
https://gitlab.com/gnutls/gnutls/commit/3efb6c5fd0e3822ec11879d5bcbea0e8d322cd03
ext/status_request: Removed the parsing of responder IDs from client extension

Doc:
https://gitlab.com/gnutls/gnutls/commit/e1d6c59a7b0392fb3b8b75035614084a53e2c8c9
gnutls_ocsp_status_request_enable_client: documented requirements for parameters

Comment 5 Swamp Workflow Management 2017-07-11 19:15:09 UTC

SUSE-SU-2017:1838-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1034173,1038337,1043398
CVE References: CVE-2017-7507,CVE-2017-7869
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    gnutls-3.2.15-18.3.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    gnutls-3.2.15-18.3.1
SUSE Linux Enterprise Server 12-SP2 (src):    gnutls-3.2.15-18.3.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    gnutls-3.2.15-18.3.1

Comment 6 Andreas Stieger 2017-07-14 18:45:46 UTC

release 42.2, done

Comment 7 Swamp Workflow Management 2017-07-14 22:15:24 UTC

openSUSE-SU-2017:1875-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1034173,1038337,1043398
CVE References: CVE-2017-7507,CVE-2017-7869
Sources used:
openSUSE Leap 42.2 (src):    gnutls-3.2.15-11.3.1