REDHAT-BUG-659297: High severity openssl vulnerability
Sébastien Martini discovered a flaw in the OpenSSL's implementation of the J-PAKE authentication protocol. OpenSSL preformed insufficient validation of the public parameters received from the untrusted party, which could use this flaw to make J-PAKE protocol generate predictable session key. Hence an attacker could use this implementation flaw to successfully authenticate (i.e. prove knowledge of the shared secret) to the peer, usually server.
Sébastien Martini paper describing this flaw, as well as proof of concept code can be found in the following github repository: https://github.com/seb-m/jpake
OpenSSL upstream fix for the issue, which should be included in version 0.9.8q and 1.0.0c: http://cvs.openssl.org/chngview?cn=20098
Note: J-PAKE implementation is considered experimental upstream and is not enabled by default.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using OpenSSL's experimental J-PAKE authentication implementation are exposed if that functionality has been enabled. J-PAKE is not enabled by default upstream, so default OpenSSL configurations are not affected.
What does an attacker need to exploit the flaw?
An attacker needs to act as the untrusted party in a J-PAKE exchange and supply insufficiently validated public parameters. This can cause generation of a predictable session key and allow the attacker to authenticate to the peer as though they know the shared secret.
How can I determine whether my deployment is affected?
Determine whether OpenSSL J-PAKE support has been explicitly enabled and is being used for authentication. Deployments that do not use the experimental J-PAKE implementation are not affected.
What can be done if an update cannot be applied immediately?
Disable or stop using OpenSSL J-PAKE authentication until the upstream fix is available. Because J-PAKE is experimental and not enabled by default, removing that feature from use mitigates the issue.