|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2015-3152: MariaDB,mysql: mysql --ssl does not enforce SSL (oCERT-2015-003 BACKRONYM) | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Marcus Rückert <mrueckert> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P2 - High | CC: | astieger, chcao, jim.petersen, kstreitova, lchiquitto, meissner, mge, mrueckert, rasmus, security-team, stephan.barth |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| Whiteboard: | CVSSv2:RedHat:CVE-2015-3152:4.3:(AV:N/AC:M/Au:N/C:P/I:N/A:N) CVSSv3:RedHat:CVE-2015-3152:6.8:(AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) CVSSv2:NVD:CVE-2015-3152:4.3:(AV:N/AC:M/Au:N/C:N/I:P/A:N) | ||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Attachments: | Consolidated patch for #924663 | ||
|
Description
Marcus Rückert
2015-03-27 11:17:57 UTC
see bug 928962 too This issue has been fixed in maria-5.5.44. Patches: (1) https://github.com/MariaDB/server/commit/4ef74979969ac9339d0d42c11a6f26632e6776f1.patch (2) https://github.com/MariaDB/server/commit/be5035b4f4e45806c55deac962e1e413e32289ef.patch (3) https://github.com/MariaDB/server/commit/5d57e2d8cd02fd2dad3e798d89d14cbd03877cae.patch (4) https://github.com/MariaDB/server/commit/5a44e1a4024f1760021e5c6fd65773584d60513a.patch *** Bug 928962 has been marked as a duplicate of this bug. *** (In reply to MariaDB Engineering from comment #9) > This issue has been fixed in maria-5.5.44. Thank you for the patches. We have currently MariaDB 10.0.x in our products too. Can you please provide us with suitable patches? Or are patches from comment 9 suitable even for MariaDB 10.0.x branch? Thank you. Created attachment 639131 [details]
Consolidated patch for #924663
A brief note about this feature:
"--ssl on its own doesn't enforce ssl. The reasoning is the following:
Our behavior in 5.5 is that we do not implicitly verify the server's
certificate. For all we know we could be the victim of a MITM attack
without verifying the certificate. We could be sending encrypted data
to the attacker, for him to relay it further to our intended destination.
We wanted to keep this behavior consistent across released versions (5.5
and 10.0).
To enforce ssl one needs to use --ssl-verify-server-cert. This is what
the patch does, it makes --ssl-verify-server-cert to enforce a ssl
connection or abort the connection.
In 10.1 we plan to make --ssl-verify-server-cert a default option, so
the sane defaults will be that by using --ssl, by default, an ssl connection
will be enforced."
This is fixed in MariaDB 1.0.10 apparently. https://mariadb.com/kb/en/mariadb/mariadb-10020-release-notes/ (In reply to Marcus Meissner from comment #14) > This is fixed in MariaDB 1.0.10 apparently. > https://mariadb.com/kb/en/mariadb/mariadb-10020-release-notes/ It's a typing error. This is fixed in MariaDB 10.0.20. This issue is fixed since MariaDB 10.0.20 and MariaDB 5.5.44. We created a version bump to MariaDB 10.0.20 for SLE12 and to MariaDB 10.0.20 and 5.5.44 for openSUSE, so this bug is fixed there now. | Product | Affected | Request | |---------------|----------|-----------| | SLE12 | yes | mr#61330 | | openSUSE 13.1 | yes | mr#314500 | | openSUSE 13.2 | yes | mr#314500 | | devel/Factory | no* | --- | * 10.0.20 already present here Reassigning to security-team openSUSE-SU-2015:1216-1: An update that fixes 28 vulnerabilities is now available. Category: security (important) Bug References: 859345,914370,924663,934789,936407,936408,936409 CVE References: CVE-2014-6464,CVE-2014-6469,CVE-2014-6491,CVE-2014-6494,CVE-2014-6496,CVE-2014-6500,CVE-2014-6507,CVE-2014-6555,CVE-2014-6559,CVE-2014-6568,CVE-2014-8964,CVE-2015-0374,CVE-2015-0381,CVE-2015-0382,CVE-2015-0411,CVE-2015-0432,CVE-2015-0433,CVE-2015-0441,CVE-2015-0499,CVE-2015-0501,CVE-2015-0505,CVE-2015-2325,CVE-2015-2326,CVE-2015-2568,CVE-2015-2571,CVE-2015-2573,CVE-2015-3152,CVE-2015-4000 Sources used: openSUSE 13.2 (src): mariadb-10.0.20-2.9.1 openSUSE 13.1 (src): mariadb-5.5.44-4.1 Releasing MariaDB for SLE 12. SUSE-SU-2015:1273-1: An update that solves 12 vulnerabilities and has one errata is now available. Category: security (important) Bug References: 906574,919053,919062,920865,920896,921333,924663,924960,924961,934789,936407,936408,936409 CVE References: CVE-2014-8964,CVE-2015-0433,CVE-2015-0441,CVE-2015-0499,CVE-2015-0501,CVE-2015-0505,CVE-2015-2325,CVE-2015-2326,CVE-2015-2568,CVE-2015-2571,CVE-2015-2573,CVE-2015-3152 Sources used: SUSE Linux Enterprise Workstation Extension 12 (src): mariadb-10.0.20-18.1 SUSE Linux Enterprise Software Development Kit 12 (src): mariadb-10.0.20-18.1 SUSE Linux Enterprise Server 12 (src): mariadb-10.0.20-18.1 SUSE Linux Enterprise Desktop 12 (src): mariadb-10.0.20-18.1 This commit on 5.5 applies to Oracle Mysql in SLE 11 SP3/4: https://github.com/MariaDB/server/commit/4ef7497 From 4ef74979969ac9339d0d42c11a6f26632e6776f1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vicen=C8=9Biu=20Ciorbaru?= <vicentiu@mariadb.org> Date: Tue, 9 Jun 2015 14:08:44 +0300 Subject: [PATCH] MDEV-7937: Enforce SSL when --ssl client option is used Using --ssl-verify-server-cert and --ssl[-*] implies that the ssl connection is required. The mysql client will now print an error if ssl is required, but the server can not handle a ssl connection. --- sql-common/client.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) Related tests (partial) https://github.com/MariaDB/server/commit/5a44e1a http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-3.html#mysqld-5-7-3-security Documented as "Incompatible Change" Changes meaning of --ssl, adds MYSQL_OPT_SSL_ENFORCE Patch from comment 25 was submitted for SLE11SP3 (https://build.suse.de/request/show/68980) Reassigning to security-team. Adjusted MariaDB patch from comment 25 was commited to our openSUSE mysql-packaging git repo (https://github.com/openSUSE/mysql-packaging/commit/23133cf21bbcb812afceb1a5847a9d795c25ec1b) SUSE-SU-2015:1788-1: An update that fixes 19 vulnerabilities is now available. Category: security (moderate) Bug References: 924663,928962,934401,938412 CVE References: CVE-2015-2582,CVE-2015-2611,CVE-2015-2617,CVE-2015-2620,CVE-2015-2639,CVE-2015-2641,CVE-2015-2643,CVE-2015-2648,CVE-2015-2661,CVE-2015-3152,CVE-2015-4737,CVE-2015-4752,CVE-2015-4756,CVE-2015-4757,CVE-2015-4761,CVE-2015-4767,CVE-2015-4769,CVE-2015-4771,CVE-2015-4772 Sources used: SUSE Linux Enterprise Software Development Kit 11-SP4 (src): mysql-5.5.45-0.11.1 SUSE Linux Enterprise Software Development Kit 11-SP3 (src): mysql-5.5.45-0.11.1 SUSE Linux Enterprise Server for VMWare 11-SP3 (src): mysql-5.5.45-0.11.1 SUSE Linux Enterprise Server 11-SP4 (src): mysql-5.5.45-0.11.1 SUSE Linux Enterprise Server 11-SP3 (src): mysql-5.5.45-0.11.1 SUSE Linux Enterprise Desktop 11-SP4 (src): mysql-5.5.45-0.11.1 SUSE Linux Enterprise Desktop 11-SP3 (src): mysql-5.5.45-0.11.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): mysql-5.5.45-0.11.1 SUSE Linux Enterprise Debuginfo 11-SP3 (src): mysql-5.5.45-0.11.1 openSUSE-SU-2015:2243-1: An update that fixes 30 vulnerabilities is now available. Category: security (important) Bug References: 924663,928962,951391 CVE References: CVE-2015-0286,CVE-2015-0288,CVE-2015-1789,CVE-2015-1793,CVE-2015-3152,CVE-2015-4730,CVE-2015-4766,CVE-2015-4792,CVE-2015-4800,CVE-2015-4802,CVE-2015-4815,CVE-2015-4816,CVE-2015-4819,CVE-2015-4826,CVE-2015-4830,CVE-2015-4833,CVE-2015-4836,CVE-2015-4858,CVE-2015-4861,CVE-2015-4862,CVE-2015-4864,CVE-2015-4866,CVE-2015-4870,CVE-2015-4879,CVE-2015-4890,CVE-2015-4895,CVE-2015-4904,CVE-2015-4905,CVE-2015-4910,CVE-2015-4913 Sources used: openSUSE Leap 42.1 (src): mysql-community-server-5.6.27-8.1 openSUSE 13.2 (src): mysql-community-server-5.6.27-2.12.1 openSUSE 13.1 (src): mysql-community-server-5.6.27-7.13.1 released i think News about BACKRONYM and MySQL: Initially, MySQL fixed this issue for 5.7 branch only. Afterwards, they decided to release a mitigation of this issue for 5.5 a 5.6 branches (--ssl-mode=REQUIRED specifies to require a secure connection (without API support)): - 5.5.49: https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-49.html#mysqld-5-5-49-security - 5.6.30: https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-30.html#mysqld-5-6-30-security However, the implementation of this mitigation was not correct and it caused the RIDDLE vulnerability (CVE-2017-3305, bug 1029396). As a reaction, MySQL released a fix in the latest MySQL 5.5.55 and 5.6.36: - 5.5.55: https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-55.html#mysqld-5-5-55-security - 5.6.36: https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-36.html#mysqld-5-6-36-security Now, MySQL 5.5 and 5.6 use '--ssl-mode=REQUIRED' option (with API support) to specify that the secure connection is required. This is an autogenerated message for OBS integration: This bug (924663) was mentioned in https://build.opensuse.org/request/show/490980 42.1+42.2 / mysql-community-server |