CVE-2018-21029

systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there is no hostname validation with the GnuTLS backend. NOTE: This has been disputed by the developer as not a vulnerability since hostname validation does not have anything to do with this issue (i.e. there is no hostname to be sent)

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://blog.cloudflare.com/dns-encryption-explained/	Third Party Advisory
https://github.com/systemd/systemd/blob/v239/man/resolved.conf.xml#L199-L207	Exploit Third Party Advisory
https://github.com/systemd/systemd/blob/v243/man/resolved.conf.xml#L196-L207	Exploit Third Party Advisory
https://github.com/systemd/systemd/blob/v243/src/resolve/resolved-dnstls-gnutls.c#L62-L63	Patch Third Party Advisory
https://github.com/systemd/systemd/issues/9397	Issue Tracking Third Party Advisory
https://github.com/systemd/systemd/pull/13870	Patch Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4NLJVOJMB6ANDILRLDZK26YGLYBEPHKY/
https://security.netapp.com/advisory/ntap-20191122-0002/	Third Party Advisory
https://tools.ietf.org/html/rfc7858#section-4.1	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-10-30 22:15

Updated : 2024-05-17 01:27

NVD link : CVE-2018-21029

Mitre link : CVE-2018-21029

CVE.ORG link : CVE-2018-21029

JSON object : View

Products Affected

systemd_project

systemd

fedoraproject

fedora

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2018-21029", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-10-30T22:15:10.667", "references": [{"url": "https://blog.cloudflare.com/dns-encryption-explained/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/systemd/systemd/blob/v239/man/resolved.conf.xml#L199-L207", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/systemd/systemd/blob/v243/man/resolved.conf.xml#L196-L207", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/systemd/systemd/blob/v243/src/resolve/resolved-dnstls-gnutls.c#L62-L63", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/systemd/systemd/issues/9397", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/systemd/systemd/pull/13870", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4NLJVOJMB6ANDILRLDZK26YGLYBEPHKY/", "source": "cve@mitre.org"}, {"url": "https://security.netapp.com/advisory/ntap-20191122-0002/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://tools.ietf.org/html/rfc7858#section-4.1", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there is no hostname validation with the GnuTLS backend. NOTE: This has been disputed by the developer as not a vulnerability since hostname validation does not have anything to do with this issue (i.e. there is no hostname to be sent)"}, {"lang": "es", "value": "** EN DISPUTA ** systemd versiones 239 hasta la versi\u00f3n 245, acepta cualquier certificado firmado por parte de una autoridad de certificaci\u00f3n de confianza para DNS Over TLS. La indicaci\u00f3n de nombre de servidor (SNI) no se env\u00eda y no existe comprobaci\u00f3n de nombre de host con el backend GnuTLS. NOTA: Esto ha sido discutido por el desarrollador como una vulnerabilidad, ya que la validaci\u00f3n del hostname no tiene nada que ver con este problema (es decir, no hay ning\u00fan nombre de host que se env\u00ede)"}], "lastModified": "2024-05-17T01:27:14.277", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A177E47-87C0-4499-8DE8-3F7C75FF4FEE", "versionEndExcluding": "244", "versionStartIncluding": "239"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}