Bug 1179593 - (CVE-2020-8286) VUL-0: CVE-2020-8286: curl: Inferior OCSP verification (3/3)
(CVE-2020-8286)
VUL-0: CVE-2020-8286: curl: Inferior OCSP verification (3/3)
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/272732/
CVSSv3.1:SUSE:CVE-2020-8286:6.5:(AV:N...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2020-12-04 10:15 UTC by Robert Frohl
Modified: 2021-10-04 14:36 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 7 Marcus Meissner 2020-12-09 07:03:10 UTC
now public:

Inferior OCSP verification
==========================

Project curl Security Advisory, December 9th 2020 -
[Permalink](https://curl.se/docs/CVE-2020-8286.html)

VULNERABILITY
-------------

libcurl offers "OCSP stapling" via the `CURLOPT_SSL_VERIFYSTATUS` option. When
set, libcurl verifies the OCSP response that a server responds with as part of
the TLS handshake. It then aborts the TLS negotiation if something is wrong
with the response. The same feature can be enabled with `--cert-status` using
the curl tool.

As part of the OCSP response verification, a client should verify that the
response is indeed set out for the correct certificate. This step was not
performed by libcurl when built or told to use OpenSSL as TLS backend.

This flaw would allow an attacker, who perhaps could have breached a TLS
server, to provide a fraudulent OCSP response that would appear fine, instead
of the real one. Like if the original certificate actually has been revoked.

We are not aware of any exploit of this flaw.

INFO
----

This flaw has existed in curl since commit
[d1cf5d570663d](https://github.com/curl/curl/commit/d1cf5d570663d) in curl
7.41.0.

The vulnerability is present only if OpenSSL is the designated TLS backend.
OCSP stapling is not enabled by default by libcurl, it needs to be explicitly
enabled by the application to get used.

OCSP Stapling can be used with any of the TLS based protocols curl supports,
including HTTPS, FTPS, SMTPS, POP3S, IMAPS, HTTPS-proxy and more.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2020-8286 to this issue.

CWE-299: Improper Check for Certificate Revocation

Severity: Medium

AFFECTED VERSIONS
-----------------


- Affected versions: libcurl 7.41.0 to and including 7.73.0
- Not affected versions: libcurl < 7.41.0 and libcurl >= 7.74.0

Also note that libcurl is used by many applications, and not always
advertised as such.

THE SOLUTION
------------

The OCSP response checker function now also verifies that the certificate id
is the correct one.

A [fix for CVE-2020-8286](https://github.com/curl/curl/commit/d9d01672785b)

RECOMMENDATIONS
--------------

We suggest you take one of the following actions immediately, in order of
preference:

  A - Upgrade curl to version 7.74.0

  B - Don't rely on OCSP

TIMELINE
--------

This issue was first reported to the curl project on December 2, 2020.

This advisory was posted on December 9th 2020.

CREDITS
-------

This issue was identified and patched by an Ospoco customer who wishes to
remain anonymous. Reported by Ospoco (https://ospo.co).

Thanks a lot!

-- 

  / daniel.haxx.se
  | Commercial curl support up to 24x7 is available!
  | Private help, bug fixes, support, ports, new features
  | https://www.wolfssl.com/contact/
Comment 8 Swamp Workflow Management 2020-12-09 23:18:00 UTC
SUSE-SU-2020:3733-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1179398,1179399,1179593
CVE References: CVE-2020-8284,CVE-2020-8285,CVE-2020-8286
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    curl-7.60.0-3.35.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Swamp Workflow Management 2020-12-09 23:21:03 UTC
SUSE-SU-2020:3735-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1179398,1179399,1179593
CVE References: CVE-2020-8284,CVE-2020-8285,CVE-2020-8286
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    curl-7.66.0-4.11.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2020-12-10 14:21:19 UTC
SUSE-SU-2020:3739-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1179398,1179399,1179593
CVE References: CVE-2020-8284,CVE-2020-8285,CVE-2020-8286
JIRA References: 
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    curl-7.60.0-11.9.1
SUSE Linux Enterprise Server 12-SP5 (src):    curl-7.60.0-11.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Swamp Workflow Management 2020-12-13 11:18:25 UTC
openSUSE-SU-2020:2238-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1179398,1179399,1179593
CVE References: CVE-2020-8284,CVE-2020-8285,CVE-2020-8286
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    curl-7.66.0-lp152.3.12.1, curl-mini-7.66.0-lp152.3.12.1
Comment 12 Pedro Monreal Gonzalez 2020-12-14 19:12:43 UTC
The way OpenSSL is initialized has been changed in curl 7.74.0, see:
   openssl: use OPENSSL_init_ssl() with >= 1.1.0 #6260
   https://github.com/curl/curl/pull/6260

I'll make sure this is done correctly before submitting the curl update to factory.
Comment 13 Swamp Workflow Management 2020-12-14 23:31:12 UTC
openSUSE-SU-2020:2249-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1179398,1179399,1179593
CVE References: CVE-2020-8284,CVE-2020-8285,CVE-2020-8286
JIRA References: 
Sources used:
openSUSE Leap 15.1 (src):    curl-7.60.0-lp151.5.18.1, curl-mini-7.60.0-lp151.5.18.1
Comment 14 Pedro Monreal Gonzalez 2020-12-16 12:38:29 UTC
Factory submission: https://build.opensuse.org/request/show/856452
Comment 16 Pedro Monreal Gonzalez 2020-12-16 12:46:44 UTC
Original report with more details and a reproducer here:
   https://hackerone.com/reports/1048457
Comment 17 Alexandros Toptsoglou 2021-01-27 17:10:30 UTC
DONE
Comment 19 Swamp Workflow Management 2021-05-27 19:29:21 UTC
SUSE-SU-2021:1786-1: An update that solves 6 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1175109,1177976,1179398,1179399,1179593,1183933,1186114
CVE References: CVE-2020-8231,CVE-2020-8284,CVE-2020-8285,CVE-2020-8286,CVE-2021-22876,CVE-2021-22898
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    curl-7.60.0-4.20.1
SUSE OpenStack Cloud 9 (src):    curl-7.60.0-4.20.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    curl-7.60.0-4.20.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    curl-7.60.0-4.20.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.