REDHAT-BUG-1643086: High severity openssl vulnerability
An instance of OpenSSL::X509::Name contains entities such as CN, C and so on. Some two instances of OpenSSL::X509::Name are equal only when all entities are exactly equal. However, there is a bug that the equality check is not correct if the value of an entity of the argument (right-hand side) starts with the value of the receiver (left-hand side). So, if a malicious X.509 certificate is passed to compare with an existing certificate, there is a possibility to be judged incorrectly that they are equal.
External References:
https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1643086?
The severity of REDHAT-BUG-1643086 is classified as low because it affects the equality check of OpenSSL::X509::Name but does not lead to serious security implications.
How do I fix REDHAT-BUG-1643086?
To fix REDHAT-BUG-1643086, update your OpenSSL to the latest version where the equality check issue has been addressed.
Which versions of OpenSSL are affected by REDHAT-BUG-1643086?
All versions of OpenSSL that include the faulty equality check in OpenSSL::X509::Name are affected by REDHAT-BUG-1643086.
What is the root cause of REDHAT-BUG-1643086?
The root cause of REDHAT-BUG-1643086 is an incorrect implementation in the equality comparison logic of OpenSSL::X509::Name instances.
Is there a workaround for REDHAT-BUG-1643086?
There is no official workaround for REDHAT-BUG-1643086; upgrading OpenSSL is recommended to resolve the issue.