[ssl][CVE-2019-5010] TALOS-2018-0758 Denial of Service

[Talos]

BPO	35746
Nosy	@vstinner, @larryhastings, @tiran, @ned-deily, @miss-islington, @talos
PRs	bpo-35746: Fix segfault in ssl's cert parser #11569 bpo-35746: Fix segfault in ssl's cert parser #11569 bpo-35746: Fix segfault in ssl's cert parser #11569 [3.7] bpo-35746: Fix segfault in ssl's cert parser (GH-11569) #11572 [3.7] bpo-35746: Fix segfault in ssl's cert parser (GH-11569) #11572 [3.6] bpo-35746: Fix segfault in ssl's cert parser (GH-11569) #11573 [3.6] bpo-35746: Fix segfault in ssl's cert parser (GH-11569) #11573 [2.7] bpo-35746: Fix segfault in ssl's cert parser (GH-11569) #11574 [2.7] bpo-35746: Fix segfault in ssl's cert parser (GH-11569) #11574 [2.7] bpo-35746: Fix segfault in ssl's cert parser (GH-11569) #11574 bpo-35746: Credit Colin Read and Nicolas Edet #11863 [3.7] bpo-35746: Credit Colin Read and Nicolas Edet #11864 [3.6] bpo-35746: Credit Colin Read and Nicolas Edet #11865 [2.7] bpo-35746: Credit Colin Read and Nicolas Edet #11866 [3.5] bpo-35746: Fix segfault in ssl's cert parser (GH-11569) #11867 [3.4] bpo-35746: Fix segfault in ssl's cert parser (GH-11569) #11868
Files	TALOS-2019-0758.txt: Security advisory report TALOS-2019-0758 - POC.pem: poc file

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/tiran'
closed_at = <Date 2019-03-12.11:06:07.783>
created_at = <Date 2019-01-15.16:24:28.855>
labels = ['type-security', 'expert-SSL', '3.7', '3.8']
title = '[ssl][CVE-2019-5010] TALOS-2018-0758 Denial of Service'
updated_at = <Date 2019-05-10.17:57:03.117>
user = 'https://github.com/Talos'

bugs.python.org fields:

activity = <Date 2019-05-10.17:57:03.117>
actor = 'ned.deily'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2019-03-12.11:06:07.783>
closer = 'vstinner'
components = ['SSL']
creation = <Date 2019-01-15.16:24:28.855>
creator = 'Talos'
dependencies = []
files = ['48052', '48053']
hgrepos = []
issue_num = 35746
keywords = ['patch', 'patch', 'patch']
message_count = 23.0
messages = ['333709', '333710', '333711', '333712', '333713', '333714', '333715', '333736', '333737', '333741', '333742', '333743', '333747', '333764', '334178', '335599', '335600', '335604', '335673', '336558', '336587', '337569', '337732']
nosy_count = 6.0
nosy_names = ['vstinner', 'larry', 'christian.heimes', 'ned.deily', 'miss-islington', 'Talos']
pr_nums = ['11569', '11569', '11569', '11572', '11572', '11573', '11573', '11574', '11574', '11574', '11863', '11864', '11865', '11866', '11867', '11868']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue35746'
versions = ['Python 2.7', 'Python 3.4', 'Python 3.5', 'Python 3.6', 'Python 3.7', 'Python 3.8']

[Talos]

An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

[tiran]

Thanks for the report!

[Talos]

Thanks for acknowledging. We look forward to any updates/developments on the issue reported.

For further information about the Cisco Vendor Vulnerability Reporting and Disclosure Policy please refer to this document which also links to our public PGP key. https://tools.cisco.com/security/center/resources/vendor_vulnerability_policy.html

Kind Regards,

Regina Wilson
Analyst.Business Operations
regiwils@cisco.com<mailto:regiwils@cisco.com>

[cid:CFA14CB5-B7B2-4FF7-8313-22D495F607D5@vrt.sourcefire.com]

On Jan 15, 2019, at 11:30 AM, Christian Heimes <report@bugs.python.org<mailto:report@bugs.python.org>> wrote:

Christian Heimes <lists@cheimes.de<mailto:lists@cheimes.de>> added the comment:

Thanks for the report!

----------
assignee: -> christian.heimes
components: +SSL
nosy: +christian.heimes
stage: -> needs patch
versions: +Python 3.4, Python 3.5, Python 3.6, Python 3.7, Python 3.8

---

Python tracker <report@bugs.python.org<mailto:report@bugs.python.org>>
<https://bugs.python.org/issue35746\>

---

[tiran]

I can confirm that CPython is affected.

By the way PyCA cryptography handles the CRL DB just fine.

>>> from cryptography import x509
>>> from cryptography.hazmat.backends import default_backend
>>> with open("Lib/test/talos-2019-0758.pem", "rb") as f:
...     pem_data = f.read()
... 
>>> cert = x509.load_pem_x509_certificate(pem_data, default_backend())
>>> cert.extensions[-1]
<Extension(oid=<ObjectIdentifier(oid=2.5.29.31, name=cRLDistributionPoints)>, critical=False, value=<CRLDistributionPoints([<DistributionPoint(full_name=None, relative_name=None, reasons=None, crl_issuer=None)>])>)>

[Talos]

The files are removed and will be reissued to PSIRT.

Regina Wilson
Analyst.Business Operations
regiwils@cisco.com<mailto:regiwils@cisco.com>

[cid:CFA14CB5-B7B2-4FF7-8313-22D495F607D5@vrt.sourcefire.com]

On Jan 15, 2019, at 12:11 PM, Cisco Talos <report@bugs.python.org<mailto:report@bugs.python.org>> wrote:

Change by Cisco Talos <vulndev@cisco.com<mailto:vulndev@cisco.com>>:

Removed file: https://bugs.python.org/file48052/TALOS-2019-0758.txt

---

Python tracker <report@bugs.python.org<mailto:report@bugs.python.org>>
<https://bugs.python.org/issue35746\>

---

[vstinner]

I close the bug just to hide it from the home page and default search result, to have more time to fix it (make the issue less visible).