oss-sec mailing list archives
Re: Re: openssl security issue or not? (CVE Request?)
From: Marcus Meissner <meissner () suse de>
Date: Fri, 23 Mar 2012 20:00:36 +0100
On Fri, Mar 23, 2012 at 11:29:33AM -0500, Ivan Nestlerode wrote:
Marcus Meissner <meissner () suse de> wrote on 03/23/2012 11:13:20 AM:From: Marcus Meissner <meissner () suse de> To: OSS Security List <oss-security () lists openwall com> Cc: Ivan Nestlerode/Cambridge/IBM@IBMUS Date: 03/23/2012 11:13 AM Subject: openssl security issue or not? (CVE Request?) Hi folks, Ivan, This patch: http://cvs.openssl.org/chngview?cn=22161 fixes a decrypt error return values and according to the changelog "detects symmetric crypto errors" I am not sure if this counts as security issue in the end, but "not detecting a failed decrypt" seems to me like it is a security issue. Any comments? Ciao, Marcus (also https://bugzilla.novell.com/show_bug.cgi?id=749210 )Marcus, I don't think that this change needs separate tracking as a security issue since there is no guarantee that you can detect symmetric decryption errors anyway (it is not that hard for random gibberish to decrypt with correct PKCS#5 padding). This change made its way into their CVS first, but it was actually meant to go in along with another change that is a security fix and already has a CVE entry associated with it (CVE-2012-0884): http://cvs.openssl.org/chngview?cn=22238 If a Linux distribution picks up the fix for CVE-2012-0884 then they will want to pick up change 22161 at the same time since the fix for the security vulnerability will generally cause symmetric decryption errors when it kicks in and things get very confusing for the end user without change 22161 (they will frequently get junk results with a success return value instead of an error return value). Both were reported to OpenSSL at the same time, but the CVE change was submitted later because it was more complicated and required more review and discussion. Hope that helps,
Yes, thanks Ivan and Jan! Ciao, Marcus
Current thread:
- openssl security issue or not? (CVE Request?) Marcus Meissner (Mar 23)
- Re: openssl security issue or not? (CVE Request?) Jan Lieskovsky (Mar 23)
- Re: openssl security issue or not? (CVE Request?) Ivan Nestlerode (Mar 23)
- Re: Re: openssl security issue or not? (CVE Request?) Marcus Meissner (Mar 23)