Project

General

Profile

Actions

Bug #7822

closed

CVE-2014-3691 - Smart proxy doesn't perform verification of client SSL certificate on API requests

Added by Dominic Cleal over 9 years ago. Updated over 5 years ago.

Status:
Closed
Priority:
Urgent
Assignee:
Category:
SSL
Target version:
Difficulty:
Triaged:
Fixed in Releases:
Found in Releases:

Description

Reported to foreman-security by Michael Moll. Also reported by Jon McKenzie in a comment here: http://projects.theforeman.org/issues/5651#note-1, and possibly the same as Michael Messmore's #6677 ticket.

The smart proxy when running in an SSL-secured mode permits incoming API calls to any endpoint without requiring, or performing any verification of an SSL client certificate. This permits any client with access to the API to make requests and perform actions (permitting control of Puppet CA, DHCP, DNS etc.)

Users are strongly recommended to ensure smart proxy ports (typically 8443/tcp) are firewalled so only Foreman hosts can access the service and to set the "trusted_hosts" config setting in /etc/foreman-proxy/settings.yml to a list of Foreman hostnames for host based acccess control.

See https://groups.google.com/forum/#!topic/foreman-announce/jXC5ixybjqo for more information on mitigation.


Related issues 5 (0 open5 closed)

Related to Smart Proxy - Feature #6677: Autosign entry additions should require authenticationResolved07/17/2014Actions
Related to Smart Proxy - Refactor #7832: Integration test for SSL verificationClosedDominic Cleal10/07/2014Actions
Related to Smart Proxy - Feature #7849: trusted_hosts should determine hostname from certificate CN on SSL requestsClosed10/08/2014Actions
Related to Installer - Bug #8301: Add a checker script for reverse DNSClosedChris Roberts11/06/2014Actions
Has duplicate Smart Proxy - Bug #5651: The 'trusted_hosts' config key has an unintuitive (and potentially dangerous) behaviorDuplicate05/09/2014Actions
Actions #1

Updated by Dominic Cleal over 9 years ago

  • Project changed from Foreman to Smart Proxy
  • Category changed from Security to SSL
Actions #2

Updated by Dominic Cleal over 9 years ago

  • Has duplicate Bug #5651: The 'trusted_hosts' config key has an unintuitive (and potentially dangerous) behavior added
Actions #3

Updated by Dominic Cleal over 9 years ago

  • Related to Feature #6677: Autosign entry additions should require authentication added
Actions #4

Updated by Dominic Cleal over 9 years ago

  • Status changed from New to Assigned
  • Assignee set to Dominic Cleal
Actions #5

Updated by The Foreman Bot over 9 years ago

  • Status changed from Assigned to Ready For Testing
  • Pull request https://github.com/theforeman/smart-proxy/pull/217 added
  • Pull request deleted ()
Actions #6

Updated by Dominic Cleal over 9 years ago

  • Related to Refactor #7832: Integration test for SSL verification added
Actions #7

Updated by Dominic Cleal over 9 years ago

  • Related to Feature #7849: trusted_hosts should determine hostname from certificate CN on SSL requests added
Actions #8

Updated by Dominic Cleal over 9 years ago

  • Description updated (diff)
Actions #9

Updated by Dominic Cleal over 9 years ago

  • translation missing: en.field_release set to 26
Actions #10

Updated by Dominic Cleal over 9 years ago

  • Status changed from Ready For Testing to Closed
  • % Done changed from 0 to 100
Actions #11

Updated by Dominic Cleal over 9 years ago

We plan on releasing updated foreman-proxy packages as part of 1.5.4 and 1.6.2.

Actions #12

Updated by Dominic Cleal over 9 years ago

  • Subject changed from Smart proxy doesn't perform verification of client SSL certificate on API requests to CVE-2014-3691 - Smart proxy doesn't perform verification of client SSL certificate on API requests
Actions #14

Updated by Dominic Cleal over 9 years ago

  • Related to Bug #8301: Add a checker script for reverse DNS added
Actions

Also available in: Atom PDF