Conversation

Filippo Valsorda
@FiloSottile
CVE-2021-3450 is kinda delightful because it was introduced by a change that rejects custom curve parameters (which is what broke Windows last year), and it only affects X509_V_FLAG_X509_STRICT mode. Complexity is killer.
5
62
Filippo Valsorda
@FiloSottile
CVE-2021-3449 looks like it could have been found easily if anyone figured out how to fuzz renegotiation, but renegotiation is sadness. Anyway, sounds like you can crash most OpenSSL servers on the Internet today.
7
67
Filippo Valsorda
@FiloSottile
Complexity (like custom curve parameters) not only breeds vulnerabilities (like the Windows certificate check bypass) but also complex patches, which in turn breed more vulnerabilities (CVE-2021-3449). Previously:
blog.cloudflare.com
Yet Another Padding Oracle in OpenSSL CBC Ciphersuites
Yesterday a new vulnerability has been announced in OpenSSL/LibreSSL. A padding oracle in CBC mode decryption, to be precise. Just like Lucky13. Actually, it’s in the code that fixes Lucky13.
1
37
Filippo Valsorda
@FiloSottile
Nice extra lesson from CVE-2021-3450: code that the application doesn't need should be unreachable, not just disabled. Nginx disables renegotiation, but not in a way that protects it from the crash, because until recently the only way was a callback.
Quote Tweet
Filippo Valsorda
@FiloSottile
Replying to @fapolloner @terorie_dev and @DanielMicay
My guess is that to be protected one needs to set SSL_OP_NO_RENEGOTIATION which is not the nginx default. mailman.nginx.org/pipermail/ngin Instead, I think nginx by default cancels renegotiation via SSL_CTX_set_info_callback, which is too late. github.com/nginx/nginx/bl
1
14
Daniel Micay
@DanielMicay
Replying to
@FiloSottile
I think there are bigger issues than denial of service to worry about when deploying that in production. They only have 4 additional security fixes backported and there's a lot more than that available... nginx doesn't get a CVE assignment for each fix with security implications.
1
1
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
and
@FiloSottile
If you take a look at the nginx changelog, they have assorted memory corruption fixes, denial of service fixes, etc. over the past few years. A lot of those are relevant to the obsolete LTS branches. Distributions freezing versions for years have their heads buried in the sand.
1
1