ssl_verify_funに証明書照合の脆弱性、1.1.8で修正
Summary
ErlangとElixirで使われるTLS検証ライブラリssl_verify_funに、ワイルドカード証明書のホスト名を誤って受け入れる脆弱性が公表されました。依存関係に含まれていないかを調べ、1.1.8以降へ更新してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
ErlangとElixirで使われるTLS検証ライブラリssl_verify_funに、ワイルドカード証明書のホスト名を誤って受け入れる脆弱性が公表されました。依存関係に含まれていないかを調べ、1.1.8以降へ更新してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| deadtrickster | ssl_verify_fun |
≥ a49ca56923356c7a3981692b23c42ef32c2990e0, < ca34031299cd2e0c98794c0da4ba556b94e39aad |
ca34031299cd2e0c98794c0da4ba556b94e39aad |
| Hex | ssl_verify_fun |
≥ 1.0.1, < 1.1.8 |
1.1.8 |
Original description The description as published by the source.
Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. try_match_wildcard/4 in src/ssl_verify_hostname.erl anchors only the text before and after the * of an identifier such as f*.example.net, so the wildcard also consumes dots and the certificate is accepted for f.evil.example.net. RFC 6125 confines a wildcard to the left-most label. The same matcher lets *.168.1.1 match the IP literal 192.168.1.1. Whole-label wildcards are matched correctly.
Erlang/OTP 20.0 and later check the hostname in ssl before a user verify_fun sees valid_peer, so a client that keeps server_name_indication set rejects the mismatch regardless. Exposed are clients that disable SNI, servers that verify client certificate hostnames with this library, and direct callers of verify_cert_hostname/2.
This issue affects ssl_verify_fun: from 1.0.1 before 1.1.8.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory github.com
- advisory nvd.nist.gov
- package hex.pm
- package github.com
- web github.com
- web cna.erlef.org
- web osv.dev
- web github.com
- web github.com
- web github.com
- web github.com
- web repo.hex.pm