The branch master has been updated via 4a2dac4738e42fc30f7f38d9292a9391f715757e (commit) from 9b73985f37ba01f63b9aeb5c25560d2f6409dba4 (commit)
- Log ----------------------------------------------------------------- commit 4a2dac4738e42fc30f7f38d9292a9391f715757e Author: Mark J. Cox <m...@awe.com> Date: Wed Sep 9 12:59:40 2020 +0100 Add Racoon advisory, vulnerability db entry, and newsflash pointing to the advisory ----------------------------------------------------------------------- Summary of changes: news/newsflash.txt | 1 + news/secadv/20200909.txt | 76 ++++++++++++++++++++++++++++++++++++++++++++++++ news/vulnerabilities.xml | 47 +++++++++++++++++++++++++++++- 3 files changed, 123 insertions(+), 1 deletion(-) create mode 100644 news/secadv/20200909.txt diff --git a/news/newsflash.txt b/news/newsflash.txt index edc8cc8..c1820fa 100644 --- a/news/newsflash.txt +++ b/news/newsflash.txt @@ -5,6 +5,7 @@ # headings. URL paths must all be absolute. Date: Item +09-Sep-2020: <a href="/news/secadv/20200909.txt">Security Advisory</a>: Raccoon attack</a> 05-Sep-2020: New Blog post: <a href="/blog/blog/2020/09/05/OpenSSL.ProjectAdminRole/">OpenSSL Is Looking for a Full Time Administrator and Manager</a> 06-Aug-2020: Alpha 6 of OpenSSL 3.0 is now available: please download and test it 16-Jul-2020: Alpha 5 of OpenSSL 3.0 is now available: please download and test it diff --git a/news/secadv/20200909.txt b/news/secadv/20200909.txt new file mode 100644 index 0000000..bbe32dd --- /dev/null +++ b/news/secadv/20200909.txt @@ -0,0 +1,76 @@ +OpenSSL Security Advisory [09 September 2020] +============================================= + +Raccoon Attack (CVE-2020-1968) +============================== + +Severity: Low + +The Raccoon attack exploits a flaw in the TLS specification which can lead to +an attacker being able to compute the pre-master secret in connections which +have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would +result in the attacker being able to eavesdrop on all encrypted communications +sent over that TLS connection. The attack can only be exploited if an +implementation re-uses a DH secret across multiple TLS connections. Note that +this issue only impacts DH ciphersuites and not ECDH ciphersuites. + +OpenSSL 1.1.1 is not vulnerable to this issue: it never reuses a DH secret and +does not implement any "static" DH ciphersuites. + +OpenSSL 1.0.2f and above will only reuse a DH secret if a "static" DH +ciphersuite is used. These static "DH" ciphersuites are ones that start with the +text "DH-" (for example "DH-RSA-AES256-SHA"). The standard IANA names for these +ciphersuites all start with "TLS_DH_" but excludes those that start with +"TLS_DH_anon_". + +OpenSSL 1.0.2e and below would reuse the DH secret across multiple TLS +connections in server processes unless the SSL_OP_SINGLE_DH_USE option was +explicitly configured. Therefore all ciphersuites that use DH in servers +(including ephemeral DH) are vulnerable in these versions. In OpenSSL 1.0.2f +SSL_OP_SINGLE_DH_USE was made the default and it could not be turned off as a +response to CVE-2016-0701. + +Since the vulnerability lies in the TLS specification, fixing the affected +ciphersuites is not viable. For this reason 1.0.2w moves the affected +ciphersuites into the "weak-ssl-ciphers" list. Support for the +"weak-ssl-ciphers" is not compiled in by default. This is unlikely to cause +interoperability problems in most cases since use of these ciphersuites is rare. +Support for the "weak-ssl-ciphers" can be added back by configuring OpenSSL at +compile time with the "enable-weak-ssl-ciphers" option. This is not recommended. + +OpenSSL 1.0.2 is out of support and no longer receiving public updates. + +Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2w. If +upgrading is not viable then users of OpenSSL 1.0.2v or below should ensure +that affected ciphersuites are disabled through runtime configuration. Also +note that the affected ciphersuites are only available on the server side if a +DH certificate has been configured. These certificates are very rarely used and +for this reason this issue has been classified as LOW severity. + +This issue was found by Robert Merget, Marcus Brinkmann, Nimrod Aviram and Juraj +Somorovsky and reported to OpenSSL on 28th May 2020 under embargo in order to +allow co-ordinated disclosure with other implementations. + +Note +==== + +OpenSSL 1.0.2 is out of support and no longer receiving public updates. Extended +support is available for premium support customers: +https://www.openssl.org/support/contracts.html + +OpenSSL 1.1.0 is out of support and no longer receiving updates of any kind. +The impact of this issue on OpenSSL 1.1.0 has not been analysed. + +Users of these versions should upgrade to OpenSSL 1.1.1. + +References +========== + +URL for this Security Advisory: +https://www.openssl.org/news/secadv/20200909.txt + +Note: the online version of the advisory may be updated with additional details +over time. + +For details of OpenSSL severity classifications please see: +https://www.openssl.org/policies/secpolicy.html diff --git a/news/vulnerabilities.xml b/news/vulnerabilities.xml index 697c3c9..9b7dcb6 100644 --- a/news/vulnerabilities.xml +++ b/news/vulnerabilities.xml @@ -7,7 +7,52 @@ <!-- The updated attribute should be the same as the first public issue, unless an old entry was updated. --> -<security updated="20200421"> +<security updated="20200909"> + <issue public="20200909"> + <impact severity="Low"/> + <cve name="2020-1968"/> + <affects base="1.0.2" version="1.0.2"/> + <affects base="1.0.2" version="1.0.2a"/> + <affects base="1.0.2" version="1.0.2b"/> + <affects base="1.0.2" version="1.0.2c"/> + <affects base="1.0.2" version="1.0.2d"/> + <affects base="1.0.2" version="1.0.2e"/> + <affects base="1.0.2" version="1.0.2f"/> + <affects base="1.0.2" version="1.0.2g"/> + <affects base="1.0.2" version="1.0.2h"/> + <affects base="1.0.2" version="1.0.2i"/> + <affects base="1.0.2" version="1.0.2j"/> + <affects base="1.0.2" version="1.0.2k"/> + <affects base="1.0.2" version="1.0.2l"/> + <affects base="1.0.2" version="1.0.2m"/> + <affects base="1.0.2" version="1.0.2n"/> + <affects base="1.0.2" version="1.0.2o"/> + <affects base="1.0.2" version="1.0.2p"/> + <affects base="1.0.2" version="1.0.2q"/> + <affects base="1.0.2" version="1.0.2r"/> + <affects base="1.0.2" version="1.0.2s"/> + <affects base="1.0.2" version="1.0.2t"/> + <affects base="1.0.2" version="1.0.2u"/> + <affects base="1.0.2" version="1.0.2v"/> + <fixed base="1.0.2" version="1.0.2w" date="20200909"></fixed> + <problemtype>Protocol flaw</problemtype> + <title>Raccoon attack</title> + <description> +The Raccoon attack exploits a flaw in the TLS specification which can lead to +an attacker being able to compute the pre-master secret in connections which +have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would +result in the attacker being able to eavesdrop on all encrypted communications +sent over that TLS connection. The attack can only be exploited if an +implementation re-uses a DH secret across multiple TLS connections. Note that +this issue only impacts DH ciphersuites and not ECDH ciphersuites. + +This issue affects OpenSSL 1.0.2 which is out of support and no longer +receiving public updates. OpenSSL 1.1.1 is not vulnerable to this +issue. + </description> + <advisory url="/news/secadv/20200909.txt"/> + <reported source="Robert Merget, Marcus Brinkmann, Nimrod Aviram, and Juraj Somorovsky"/> + </issue> <issue public="20200421"> <impact severity="High"/> <cve name="2020-1967"/>