You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2015/01/19 16:37:17 UTC

[Bug 57465] New: Build TC Native with with latest OpenSSL to address CVEs

https://issues.apache.org/bugzilla/show_bug.cgi?id=57465

            Bug ID: 57465
           Summary: Build TC Native with with latest OpenSSL to address
                    CVEs
           Product: Tomcat Native
           Version: 1.1.32
          Hardware: PC
            Status: NEW
          Severity: major
          Priority: P2
         Component: Library
          Assignee: dev@tomcat.apache.org
          Reporter: brian.m.pickens@gmail.com

OpenSSL has a reported 8 CVE's affecting 1.0.1j and older since October last
year, which is the version that's built into the latest windows binary, version
1.1.32.

Please build with the latest version of OpenSSL (1.0.1l at this time) which
addresses all of these issues.

https://www.openssl.org/news/vulnerabilities.html

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

[Bug 57465] Build TC Native with with latest OpenSSL to address CVEs

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=57465

--- Comment #2 from brian.m.pickens@gmail.com ---
Unless I'm somehow mistaken I believe the following CVEs apply to openssl
1.0.1j and I believe tcnative 1.1.31 is built with 1.0.1j.

CVE-2014-3569: 21st October 2014
CVE-2014-8275: 5th January 2015
CVE-2014-3572: 5th January 2015
CVE-2015-0204: 6th January 2015
CVE-2014-3570: 8th January 2015
CVE-2015-0205: 8th January 2015
CVE-2015-0206: 8th January 2015
CVE-2014-3571: 8th January 2015

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

[Bug 57465] Build TC Native with with latest OpenSSL to address CVEs

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=57465

--- Comment #6 from Mark Thomas <ma...@apache.org> ---
DTLS is not supported by tc-native.

Neither was the no-ssl3 buidl option used to produce the Windows binaries.

The client issues are also clearly not relevant.

That leaves three issues, all of which appear to very unlikely to impact
tc-native users. In the unlikely event of folks needing fixes for these issues
it isn't that hard to build tc-native now that the build process has been fully
documented on the wiki:
http://wiki.apache.org/tomcat/BuildTcNativeWin

I am therefore minded to close this as WONTFIX, subject to a re-evaluation of
that decision if we discover one or more of the 3 remaining issues are more
likely that we thought to impact tc-native users.

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

[Bug 57465] Build TC Native with with latest OpenSSL to address CVEs

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=57465

--- Comment #3 from brian.m.pickens@gmail.com ---
(In reply to brian.m.pickens from comment #2)
> Unless I'm somehow mistaken I believe the following CVEs apply to openssl
> 1.0.1j and I believe tcnative 1.1.31 is built with 1.0.1j.
> 
> CVE-2014-3569: 21st October 2014
> CVE-2014-8275: 5th January 2015
> CVE-2014-3572: 5th January 2015
> CVE-2015-0204: 6th January 2015
> CVE-2014-3570: 8th January 2015
> CVE-2015-0205: 8th January 2015
> CVE-2015-0206: 8th January 2015
> CVE-2014-3571: 8th January 2015

Basically according to these CVEs the specified openssl version is vulnerable
to ddos attacks, downgraded key attacks, and removal of forward secrecy
attacks, these being the most critical of the rest.

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

[Bug 57465] Build TC Native with with latest OpenSSL to address CVEs

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=57465

Brett Randall <ja...@gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |javabrett@gmail.com

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

[Bug 57465] Build TC Native with with latest OpenSSL to address CVEs

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=57465

--- Comment #4 from Mark Thomas <ma...@apache.org> ---
Again, which of those do you think apply to tc-native? Just because OpenSSL has
a vulnerability that does not mean that tc-native automatically has the
vulnerability.

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

[Bug 57465] Build TC Native with with latest OpenSSL to address CVEs

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=57465

Mark Thomas <ma...@apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 OS|                            |All

--- Comment #1 from Mark Thomas <ma...@apache.org> ---
Which vulnreability do think think applies to the tc-native binary? I don't see
anything in the most recent OpenSSL announcement that would require a new
tc-native release.

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

[Bug 57465] Build TC Native with with latest OpenSSL to address CVEs

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=57465

--- Comment #5 from brian.m.pickens@gmail.com ---
(In reply to Mark Thomas from comment #4)
> Again, which of those do you think apply to tc-native? Just because OpenSSL
> has a vulnerability that does not mean that tc-native automatically has the
> vulnerability.

I admit most of those CVEs effect the ssl3_get_key_exchange function, which I
believe ssl3 is switched off in tcnative by default and is known to be an
insecure protocol. And I do not know if DTLS is a protocol supported by tomcat
native. However the reported ability to defeat the certificate blacklist does
seems somewhat problematic as reported in CVE-2014-8275.

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org