[Bug 1374730] [NEW] X509 certificate verification problem
Public bug reported: Hostname verification is an important step when verifying X509 certificates, however, people tend to miss the step when using SSL/TLS, which might cause severe man in the middle attack and break the entire TLS mechanism. We believe that keepalived didn't check whether the hostname matches the name in the ssl certificate and the expired date of the certificate. We found the vulnerability by static analysis, typically, a process of verfication involves calling a chain of API, and we can deduce whether the communication process is vulnerable by detecting whether the process satisfies a certain relation. The result format is like this: notice: Line Number@Method Name, Source File We provide this result to help developers to locate the problem faster. This is the result for keepalived: PDG]ssl_connect'1 [Found]SSL_connect() [HASH] 1598777261 [LineNo]@ 211[Kind]call-site[Char] SSL_connect()[Src] /home/roca/workspace/codebase/code/ubuntu_pkg/keepalived/keepalived-1.2.2/keepalived/check/check_ssl.c [Warning] SSL_new() not found! [PDG]ssl_connect [Found]SSL_connect() [HASH] 2061808858 [LineNo]@ 107[Kind]call-site[Char] SSL_connect()[Src] /home/roca/workspace/codebase/code/ubuntu_pkg/keepalived/keepalived-1.2.2/genhash/ssl.c [Warning] SSL_new() not found! We don't have a POC because we didn't succeed in configuring this software or don't know the way to verify the vulnerability. But through the analysis of the source code, we believe it breaks the ssl certificate verfication protocol. for more information about the importance of checking hostname: see http://people.stfx.ca/x2011/x2011ucj/SSL/p38-georgiev.pdf Thanks. ** Affects: keepalived (Ubuntu) Importance: Undecided Status: New ** Information type changed from Private Security to Public -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to keepalived in Ubuntu. https://bugs.launchpad.net/bugs/1374730 Title: X509 certificate verification problem To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/keepalived/+bug/1374730/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1371133] Re: prep / ppc64el boot broken. tries install to prep partition
This bug was fixed in the package curtin - 0.1.0~bzr190-0ubuntu1 --- curtin (0.1.0~bzr190-0ubuntu1) utopic; urgency=medium * New upstream snapshot. * add log reporter (LP: #1369129, LP: #1371218) * allow debug messages of helper programs to be seen * fix 'make check' * handle utf-8 output correctly. (LP: #1370249) * set root device correctly on ppc64 (LP: #1371133) * call update-grub to ensure grub.cfg is written (LP: #1373137) * fix dd-tgz mode, only call partprobe on target device. -- Scott Moser smo...@ubuntu.com Fri, 26 Sep 2014 17:26:34 -0400 ** Branch linked: lp:ubuntu/utopic-proposed/curtin ** Changed in: curtin (Ubuntu) Status: Confirmed = Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to curtin in Ubuntu. https://bugs.launchpad.net/bugs/1371133 Title: prep / ppc64el boot broken. tries install to prep partition To manage notifications about this bug go to: https://bugs.launchpad.net/curtin/+bug/1371133/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1371218] Re: curtin output badly broken. command errors ignored.
This bug was fixed in the package curtin - 0.1.0~bzr190-0ubuntu1 --- curtin (0.1.0~bzr190-0ubuntu1) utopic; urgency=medium * New upstream snapshot. * add log reporter (LP: #1369129, LP: #1371218) * allow debug messages of helper programs to be seen * fix 'make check' * handle utf-8 output correctly. (LP: #1370249) * set root device correctly on ppc64 (LP: #1371133) * call update-grub to ensure grub.cfg is written (LP: #1373137) * fix dd-tgz mode, only call partprobe on target device. -- Scott Moser smo...@ubuntu.com Fri, 26 Sep 2014 17:26:34 -0400 ** Branch linked: lp:ubuntu/utopic-proposed/curtin ** Changed in: curtin (Ubuntu) Status: Fix Committed = Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to curtin in Ubuntu. https://bugs.launchpad.net/bugs/1371218 Title: curtin output badly broken. command errors ignored. To manage notifications about this bug go to: https://bugs.launchpad.net/curtin/+bug/1371218/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1373137] Re: need to run update-grub when grub-install
This bug was fixed in the package curtin - 0.1.0~bzr190-0ubuntu1 --- curtin (0.1.0~bzr190-0ubuntu1) utopic; urgency=medium * New upstream snapshot. * add log reporter (LP: #1369129, LP: #1371218) * allow debug messages of helper programs to be seen * fix 'make check' * handle utf-8 output correctly. (LP: #1370249) * set root device correctly on ppc64 (LP: #1371133) * call update-grub to ensure grub.cfg is written (LP: #1373137) * fix dd-tgz mode, only call partprobe on target device. -- Scott Moser smo...@ubuntu.com Fri, 26 Sep 2014 17:26:34 -0400 ** Branch linked: lp:ubuntu/utopic-proposed/curtin ** Changed in: curtin (Ubuntu) Status: Triaged = Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to curtin in Ubuntu. https://bugs.launchpad.net/bugs/1373137 Title: need to run update-grub when grub-install To manage notifications about this bug go to: https://bugs.launchpad.net/curtin/+bug/1373137/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1369514] Re: django-pyscss can't find bootstrap files from xstatic
** Changed in: horizon Status: In Progress = Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to python-django-pyscss in Ubuntu. https://bugs.launchpad.net/bugs/1369514 Title: django-pyscss can't find bootstrap files from xstatic To manage notifications about this bug go to: https://bugs.launchpad.net/horizon/+bug/1369514/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
