[ssl][CVE-2019-5010] TALOS-2018-0758 Denial of Service #79927

Talos · 2019-01-15T16:24:29Z

BPO	35746
Nosy	@vstinner, @larryhastings, @tiran, @ned-deily, @miss-islington, @talos
PRs	bpo-35746: Fix segfault in ssl's cert parser #11569 bpo-35746: Fix segfault in ssl's cert parser #11569 bpo-35746: Fix segfault in ssl's cert parser #11569 [3.7] bpo-35746: Fix segfault in ssl's cert parser (GH-11569) #11572 [3.7] bpo-35746: Fix segfault in ssl's cert parser (GH-11569) #11572 [3.6] bpo-35746: Fix segfault in ssl's cert parser (GH-11569) #11573 [3.6] bpo-35746: Fix segfault in ssl's cert parser (GH-11569) #11573 [2.7] bpo-35746: Fix segfault in ssl's cert parser (GH-11569) #11574 [2.7] bpo-35746: Fix segfault in ssl's cert parser (GH-11569) #11574 [2.7] bpo-35746: Fix segfault in ssl's cert parser (GH-11569) #11574 bpo-35746: Credit Colin Read and Nicolas Edet #11863 [3.7] bpo-35746: Credit Colin Read and Nicolas Edet #11864 [3.6] bpo-35746: Credit Colin Read and Nicolas Edet #11865 [2.7] bpo-35746: Credit Colin Read and Nicolas Edet #11866 [3.5] bpo-35746: Fix segfault in ssl's cert parser (GH-11569) #11867 [3.4] bpo-35746: Fix segfault in ssl's cert parser (GH-11569) #11868
Files	TALOS-2019-0758.txt: Security advisory report TALOS-2019-0758 - POC.pem: poc file

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/tiran'
closed_at = <Date 2019-03-12.11:06:07.783>
created_at = <Date 2019-01-15.16:24:28.855>
labels = ['type-security', 'expert-SSL', '3.7', '3.8']
title = '[ssl][CVE-2019-5010] TALOS-2018-0758 Denial of Service'
updated_at = <Date 2019-05-10.17:57:03.117>
user = 'https://github.com/Talos'

bugs.python.org fields:

activity = <Date 2019-05-10.17:57:03.117>
actor = 'ned.deily'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2019-03-12.11:06:07.783>
closer = 'vstinner'
components = ['SSL']
creation = <Date 2019-01-15.16:24:28.855>
creator = 'Talos'
dependencies = []
files = ['48052', '48053']
hgrepos = []
issue_num = 35746
keywords = ['patch', 'patch', 'patch']
message_count = 23.0
messages = ['333709', '333710', '333711', '333712', '333713', '333714', '333715', '333736', '333737', '333741', '333742', '333743', '333747', '333764', '334178', '335599', '335600', '335604', '335673', '336558', '336587', '337569', '337732']
nosy_count = 6.0
nosy_names = ['vstinner', 'larry', 'christian.heimes', 'ned.deily', 'miss-islington', 'Talos']
pr_nums = ['11569', '11569', '11569', '11572', '11572', '11573', '11573', '11574', '11574', '11574', '11863', '11864', '11865', '11866', '11867', '11868']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue35746'
versions = ['Python 2.7', 'Python 3.4', 'Python 3.5', 'Python 3.6', 'Python 3.7', 'Python 3.8']

Talos · 2019-01-15T16:24:28Z

An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

tiran · 2019-01-15T16:30:21Z

Thanks for the report!

Talos · 2019-01-15T16:38:20Z

Thanks for acknowledging. We look forward to any updates/developments on the issue reported.

For further information about the Cisco Vendor Vulnerability Reporting and Disclosure Policy please refer to this document which also links to our public PGP key. https://tools.cisco.com/security/center/resources/vendor_vulnerability_policy.html

Kind Regards,

Regina Wilson
Analyst.Business Operations
regiwils@cisco.com<mailto:regiwils@cisco.com>

[cid:CFA14CB5-B7B2-4FF7-8313-22D495F607D5@vrt.sourcefire.com]

On Jan 15, 2019, at 11:30 AM, Christian Heimes <report@bugs.python.org<mailto:report@bugs.python.org>> wrote:

Christian Heimes <lists@cheimes.de<mailto:lists@cheimes.de>> added the comment:

Thanks for the report!

----------
assignee: -> christian.heimes
components: +SSL
nosy: +christian.heimes
stage: -> needs patch
versions: +Python 3.4, Python 3.5, Python 3.6, Python 3.7, Python 3.8

Python tracker <report@bugs.python.org<mailto:report@bugs.python.org>>
<https://bugs.python.org/issue35746\>

tiran · 2019-01-15T16:54:46Z

I can confirm that CPython is affected.

By the way PyCA cryptography handles the CRL DB just fine.

>>> from cryptography import x509
>>> from cryptography.hazmat.backends import default_backend
>>> with open("Lib/test/talos-2019-0758.pem", "rb") as f:
...     pem_data = f.read()
... 
>>> cert = x509.load_pem_x509_certificate(pem_data, default_backend())
>>> cert.extensions[-1]
<Extension(oid=<ObjectIdentifier(oid=2.5.29.31, name=cRLDistributionPoints)>, critical=False, value=<CRLDistributionPoints([<DistributionPoint(full_name=None, relative_name=None, reasons=None, crl_issuer=None)>])>)>

Talos · 2019-01-15T17:15:27Z

The files are removed and will be reissued to PSIRT.

Regina Wilson
Analyst.Business Operations
regiwils@cisco.com<mailto:regiwils@cisco.com>

[cid:CFA14CB5-B7B2-4FF7-8313-22D495F607D5@vrt.sourcefire.com]

On Jan 15, 2019, at 12:11 PM, Cisco Talos <report@bugs.python.org<mailto:report@bugs.python.org>> wrote:

Change by Cisco Talos <vulndev@cisco.com<mailto:vulndev@cisco.com>>:

Removed file: https://bugs.python.org/file48052/TALOS-2019-0758.txt

Python tracker <report@bugs.python.org<mailto:report@bugs.python.org>>
<https://bugs.python.org/issue35746\>

vstinner · 2019-01-15T17:17:37Z

I close the bug just to hide it from the home page and default search result, to have more time to fix it (make the issue less visible).

tiran · 2019-01-15T17:20:34Z

Please leave the bug open and don't remove files. It's too late. The bug report has been sent to mailing lists and RSS feeds already.

Also you cannot remove any files from the bug tracker. Only admins are can do that.

larryhastings · 2019-01-15T22:46:54Z

I can confirm this crashes a freshly-built interpreter from the current 3.5 and 3.4 branches.

miss-islington · 2019-01-15T22:47:50Z

New changeset a37f524 by Miss Islington (bot) (Christian Heimes) in branch 'master':
bpo-35746: Fix segfault in ssl's cert parser (GH-11569)
a37f524

miss-islington · 2019-01-15T23:03:39Z

New changeset be5de95 by Miss Islington (bot) in branch '3.7':
bpo-35746: Fix segfault in ssl's cert parser (GH-11569)
be5de95

vstinner · 2019-01-15T23:08:07Z

TALOS-2019-0758.txt: "Credit: Discovered by Colin Read and Nicolas Edet of Cisco."

Can we credit them somewhere? Maybe edit the NEWS entry to mention their name?

miss-islington · 2019-01-15T23:11:55Z

New changeset 06b1542 by Miss Islington (bot) in branch '2.7':
bpo-35746: Fix segfault in ssl's cert parser (GH-11569)
06b1542

ned-deily · 2019-01-16T01:16:40Z

New changeset 216a4d8 by Ned Deily (Miss Islington (bot)) in branch '3.6':
bpo-35746: Fix segfault in ssl's cert parser (GH-11569) (GH-11573)
216a4d8

tiran · 2019-01-16T12:42:11Z

The bug is less critical and harder to exploit than I initially thought. td;dr if you have cert validation enabled and only trust public root CAs from CA/B forum, then you are not affected.

The bug is only exploitable under two conditions:

The user has disabled TLS/SSL certificate validation *and* calls getpeercert() in 3rd party code.
Or the user trusts a CA that does not properly validate end-entity certificates.

When cert validation is enabled, the ssl module will refuse any untrusted certificate during the handshake. The SSLSocket.getpeercert() and SSLObject.getpeercert() methods raise an exception, when the handshake was not successful. Python 2.7 - 3.6 hostname verification code only calls getpeercert() after the cert chain was validated successfully. Python 3.7+ no longer calls getpeercert() for hostname verification. Further more hostname verification can't be enabled when cert validation is disabled.

For publicly trusted CAs governed by CA/B baseline requirements, CRL DPs must by valid URI general names with HTTP links. From CA/Browser Forum Baseline Requirements Version 1.6.2, December 10, 2018, section 7.1.2.3. Subscriber Certificate:

b. cRLDistributionPoints
This extension MAY be present. If present, it MUST NOT be marked critical, and it MUST contain the HTTP URL of the CA’s CRL service.

vstinner · 2019-01-21T20:52:47Z

Does someone work on backporting the fix to 3.4 and 3.5 branches?

Note: I added the vulnerability to:
https://python-security.readthedocs.io/vuln/ssl-crl-dps-dos.html

vstinner · 2019-02-15T11:25:50Z

New changeset 355f16f by Victor Stinner in branch 'master':
bpo-35746: Credit Colin Read and Nicolas Edet (GH-11863)
355f16f

vstinner · 2019-02-15T11:34:20Z

New changeset 826a8b7 by Victor Stinner in branch '2.7':
bpo-35746: Credit Colin Read and Nicolas Edet (GH-11866)
826a8b7

vstinner · 2019-02-15T12:19:33Z

New changeset fe42122 by Victor Stinner in branch '3.7':
bpo-35746: Credit Colin Read and Nicolas Edet (GH-11864)
fe42122

ned-deily · 2019-02-16T07:23:56Z

New changeset 2a3af94 by Ned Deily (Victor Stinner) in branch '3.6':
bpo-35746: Credit Colin Read and Nicolas Edet (GH-11865)
2a3af94

larryhastings · 2019-02-25T21:28:39Z

New changeset 6c655ce by larryhastings (Victor Stinner) in branch '3.4':
bpo-35746: Fix segfault in ssl's cert parser (GH-11569) (bpo-11868)
6c655ce

larryhastings · 2019-02-26T00:17:06Z

New changeset efec763 by larryhastings (Victor Stinner) in branch '3.5':
bpo-35746: Fix segfault in ssl's cert parser (GH-11569) (bpo-11867)
efec763

larryhastings · 2019-03-09T10:13:38Z

Can we close this now?

vstinner · 2019-03-12T11:06:08Z

Yes, I close the issue.

Talos mannequin added 3.7 (EOL) end of life 3.8 only security fixes type-security A security issue and removed 3.7 (EOL) end of life 3.8 only security fixes labels Jan 15, 2019

tiran added topic-SSL 3.7 (EOL) end of life 3.8 only security fixes labels Jan 15, 2019

tiran self-assigned this Jan 15, 2019

vstinner closed this as completed Jan 15, 2019

tiran reopened this Jan 15, 2019

vstinner changed the title ~~TALOS-2018-0758 Denial of Service~~ [ssl][CVE-2019-5010] TALOS-2018-0758 Denial of Service Jan 15, 2019

vstinner closed this as completed Mar 12, 2019

ezio-melotti transferred this issue from another repository Apr 10, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ssl][CVE-2019-5010] TALOS-2018-0758 Denial of Service #79927

[ssl][CVE-2019-5010] TALOS-2018-0758 Denial of Service #79927

Talos mannequin commented Jan 15, 2019

Talos mannequin commented Jan 15, 2019

tiran commented Jan 15, 2019

Talos mannequin commented Jan 15, 2019

tiran commented Jan 15, 2019

Talos mannequin commented Jan 15, 2019

vstinner commented Jan 15, 2019

tiran commented Jan 15, 2019

larryhastings commented Jan 15, 2019

miss-islington commented Jan 15, 2019

miss-islington commented Jan 15, 2019

vstinner commented Jan 15, 2019

miss-islington commented Jan 15, 2019

ned-deily commented Jan 16, 2019

tiran commented Jan 16, 2019

vstinner commented Jan 21, 2019

vstinner commented Feb 15, 2019

vstinner commented Feb 15, 2019

vstinner commented Feb 15, 2019

ned-deily commented Feb 16, 2019

larryhastings commented Feb 25, 2019

larryhastings commented Feb 26, 2019

larryhastings commented Mar 9, 2019

vstinner commented Mar 12, 2019

[ssl][CVE-2019-5010] TALOS-2018-0758 Denial of Service #79927

[ssl][CVE-2019-5010] TALOS-2018-0758 Denial of Service #79927

Comments

Talos mannequin commented Jan 15, 2019

Talos mannequin commented Jan 15, 2019

tiran commented Jan 15, 2019

Talos mannequin commented Jan 15, 2019

tiran commented Jan 15, 2019

Talos mannequin commented Jan 15, 2019

vstinner commented Jan 15, 2019

tiran commented Jan 15, 2019

larryhastings commented Jan 15, 2019

miss-islington commented Jan 15, 2019

miss-islington commented Jan 15, 2019

vstinner commented Jan 15, 2019

miss-islington commented Jan 15, 2019

ned-deily commented Jan 16, 2019

tiran commented Jan 16, 2019

vstinner commented Jan 21, 2019

vstinner commented Feb 15, 2019

vstinner commented Feb 15, 2019

vstinner commented Feb 15, 2019

ned-deily commented Feb 16, 2019

larryhastings commented Feb 25, 2019

larryhastings commented Feb 26, 2019

larryhastings commented Mar 9, 2019

vstinner commented Mar 12, 2019