[SECADV-20210325-1] CA certificate check bypass with X509_V_FLAG_X509_STRICT

Severity High

Affected Packages 3

Fixed Packages 1

CVEs 1

Invalid Certificate Verification

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the
certificates present in a certificate chain. It is not set by default.

Starting from OpenSSL version 1.1.1h a check to disallow certificates in
the chain that have explicitly encoded elliptic curve parameters was added
as an additional strict check.

An error in the implementation of this check meant that the result of a
previous check to confirm that certificates in the chain are valid CA
certificates was overwritten. This effectively bypasses the check
that non-CA certificates must not be able to issue other certificates.

If a "purpose" has been configured then there is a subsequent opportunity
for checks that the certificate is a valid CA. All of the named "purpose"
values implemented in libcrypto perform this check. Therefore, where
a purpose is set the certificate chain will still be rejected even when the
strict flag has been used. A purpose is set by default in libssl client and
server certificate verification routines, but it can be overridden or
removed by an application.

In order to be affected, an application must explicitly set the
X509_V_FLAG_X509_STRICT verification flag and either not set a purpose
for the certificate verification or, in the case of TLS client or server
applications, override the default purpose.

OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these
versions should upgrade to OpenSSL 1.1.1k.

OpenSSL 1.0.2 is not impacted by this issue.

Package	Affected Version
pkg:openssl/openssl	= 1.1.1h
pkg:openssl/openssl	= 1.1.1i
pkg:openssl/openssl	= 1.1.1j

Package	Fixed Version
pkg:openssl/openssl	= 1.1.1k

ID

SECADV-20210325-1

Severity

high

Impact

Invalid Certificate Verification

URL

https://www.openssl.org/news/secadv/20210325.txt

Published

2021-03-25T00:00:00
(3 years ago)

Modified

2021-03-25T00:00:00
(3 years ago)

Rights

The OpenSSL Project

Other Advisories

Type	Package URL	Name / Product	Version
Fixed	pkg:openssl/openssl	openssl	= 1.1.1k
Affected	pkg:openssl/openssl	openssl	= 1.1.1h
Affected	pkg:openssl/openssl	openssl	= 1.1.1i
Affected	pkg:openssl/openssl	openssl	= 1.1.1j

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date