CVE-2014-8275: Medium severity openssl vulnerability
Multiple flaws were found in the way OpenSSL parsed X.509 certificates. An attacker could use these flaws to modify an X.509 certificate to produce a certificate with a different fingerprint without invalidating its signature, and possibly bypass fingerprint-based blacklisting in applications.
Other sources
New release of OpenSSL [1] fixes the following:
By using non-DER or invalid encodings outside the signed portion of a certificate the fingerprint can be changed without breaking the signature. Although no details of the signed portion of the certificate can be changed this can cause problems with some applications: e.g. those using the certificate fingerprint for blacklists.
1. Reject signatures with non zero unused bits.
If the BIT STRING containing the signature has non zero unused bits reject the signature. All current signature algorithms require zero unused bits.
2. Check certificate algorithm consistency.
Check the AlgorithmIdentifier inside TBS matches the one in the certificate signature. NB: this will result in signature failure errors for some broken certificates.
3. Check DSA/ECDSA signatures use DER.
Reencode DSA/ECDSA signatures and compare with the original received signature. Return an error if there is a mismatch.
This will reject various cases including garbage after signature (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS program for discovering this case) and use of BER or invalid ASN.1 INTEGERs (negative or with leading zeroes).
Upstream patches: - master: https://github.com/openssl/openssl/commit/684400ce192dac51df3d3e92b61830a6ef90be3e - 0.9.8: https://github.com/openssl/openssl/commit/ec2fede9467ae1a65f452d3a39f7fbc4891d9285 - 1.0.1: https://github.com/openssl/openssl/commit/a8565530e27718760220df469f0a071c85b9e731
There was also an additional fix for this: - https://github.com/openssl/openssl/commit/cb62ab4b17818fe66d2fed0a7fe71969131c811b
[1]: https://www.openssl.org/news/changelog.html
OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/averify.c, crypto/dsa/dsaasn1.c, crypto/ecdsa/ecsvrf.c, and crypto/x509/xall.c.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2014-8275?
CVE-2014-8275 has a moderate severity level as it allows attackers to bypass fingerprint-based blacklisting through forged X.509 certificates.
How do I fix CVE-2014-8275?
To fix CVE-2014-8275, you should upgrade OpenSSL to versions 1.0.1 or higher beyond 1.0.1h, or install patched versions from the relevant vendor.
What products are affected by CVE-2014-8275?
CVE-2014-8275 affects multiple versions of OpenSSL, specifically versions 0.9.8 and 1.0.1 up to 1.0.1h.
What types of attacks can CVE-2014-8275 enable?
CVE-2014-8275 can enable attackers to create valid certificates with different fingerprints, allowing them to impersonate trusted entities.
Is there a workaround for CVE-2014-8275?
There is no reliable workaround for CVE-2014-8275 other than upgrading to a secure version of OpenSSL.