From owner-freebsd-security@freebsd.org Sat Aug 14 21:15:50 2021 Return-Path: Delivered-To: freebsd-security@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id AA9CA653895 for ; Sat, 14 Aug 2021 21:15:50 +0000 (UTC) (envelope-from cs@freebsd.org) Received: from smtp.freebsd.org (smtp.freebsd.org [IPv6:2610:1c1:1:606c::24b:4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4GnCrk3w6yz4n82 for ; Sat, 14 Aug 2021 21:15:50 +0000 (UTC) (envelope-from cs@freebsd.org) Received: from mail-ed1-f46.google.com (mail-ed1-f46.google.com [209.85.208.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "GTS CA 1O1" (verified OK)) (Authenticated sender: cs) by smtp.freebsd.org (Postfix) with ESMTPSA id 6A0E3F83B for ; Sat, 14 Aug 2021 21:15:50 +0000 (UTC) (envelope-from cs@freebsd.org) Received: by mail-ed1-f46.google.com with SMTP id n12so20536807edx.8 for ; Sat, 14 Aug 2021 14:15:50 -0700 (PDT) X-Gm-Message-State: AOAM532FK1oEeTBUZ8L9hGA7QXznLhzV5JKUeN5SEHOtNGElBYP1IGqs w+Q4gm/nnNyUQXtUsw4Gkg2z03R9uYElwek3IHDJKw== X-Google-Smtp-Source: ABdhPJwKA03ZocIENzk+X6ytRXKBLPIazWbjClq9LxHgsSZECOagBc9HiGsZNJ3ngtB0wWX+3w9oJZnN/Dnb9r2utx8= X-Received: by 2002:a50:ef14:: with SMTP id m20mr10875745eds.209.1628975749146; Sat, 14 Aug 2021 14:15:49 -0700 (PDT) MIME-Version: 1.0 References: <20210807015102.ea4f5immh2l5ku4n@sym.noone.org> In-Reply-To: From: Carlo Strub Date: Sat, 14 Aug 2021 23:15:38 +0200 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: bug in Lynx' SSL certificate validation -> leaks password in clear text via SNI (under some circumstances) To: Katherine Mcmillan Cc: "freebsd-security@freebsd.org" Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.34 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 14 Aug 2021 21:15:50 -0000 Thanks a lot for your email. I added a vuxml entry to inform users. Best, Carlo On Sat, 7 Aug 2021 at 17:07, Katherine Mcmillan wrote= : > FYI > > ________________________________ > From: Lynx-dev on > behalf of Ariadne Conill > Sent: 07 August 2021 10:17 > To: oss-security@lists.openwall.com > Cc: Axel Beckert ; lynx-dev@nongnu.org < > lynx-dev@nongnu.org>; security@debian.org ; > 991971@bugs.debian.org <991971@bugs.debian.org> > Subject: Re: [Lynx-dev] [oss-security] Re: bug in Lynx' SSL certificate > validation -> leaks password in clear text via SNI (under some > circumstances) > > Attention : courriel externe | external email > > Hi, > > On Sat, 7 Aug 2021, Thorsten Glaser wrote: > > > Axel Beckert dixit: > > > >> This is more severe than it initially looked like: Due to TLS Server > >> Name Indication (SNI) the hostname as parsed by Lynx (i.e with > >> "user:pass@" included) is sent in _clear_ text over the wire even > > > > I *ALWAYS* SAID SNI IS A SHIT THING ONLY USED AS BAD EXCUSE FOR NAT > > BY PEOPLE WHO ARE TOO STUPID TO CONFIGURE THEIR SERVERS RIGHT AND AS > > BAD EXCUSE FOR LACKING IPv6 SUPPORT, AND THEN THE FUCKING IDIOTS WENT > > AND MADE SNI *MANDATORY* FOR TLSv1.3, AND I FEEL *SO* VINDICATED RIGHT > > NOW! IDIOTS IN CHARGE OF SECURITY, FUCKING IDIOTS=E2=80=A6 > > It turns out SNI is only marginally related to this issue. The issue > itself is far more severe: HTParse() does not understand the authn part o= f > the URI at all. And so, when you call: > > HTParse("https://foo:bar@example.com", "", PARSE_HOST) > > It returns: > > foo:bar@example.com > > Which is then handed directly to SSL_set_tlsext_host_name() or > gnutls_server_name_set(). But it will also leak in the Host: header on > unencrypted connections, and also probably SSL ones too. > > As a workaround, I taught HTParse() how to parse the authn part of URIs, > but Lynx itself needs to actually properly support the authn part really. > > I have attached the patch Alpine is using to work around this infoleak. > > Ariadne > _______________________________________________ > freebsd-security@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.or= g > " >