Stay Secure with the Latest Linux Advisories

security advisorysecurity fixauthentication issue

Mageia 6: MGASA-2019-0184 Moderate: OCSP Responder TLS Flaw

When using an OCSP responder did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS (CVE-2018-8019). . MGASA-2019-0184 - Updated tomcat-native packages fix security vulnerability Publication date: 19 May 2019 URL: https://advisories.mageia.org/MGASA-2019-0184.html Type: security Affected Mageia releases: 6 CVE: CVE-2018-8019, CVE-2018-8020 When using an OCSP responder did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS (CVE-2018-8019). Did not properly check OCSP pre-produced responses. Revoked client certificates may have not been properly identified, allowing for users to authenticate with revoked certificates to connections that require mutual TLS (CVE-2018-8020). References: - https://bugs.mageia.org/show_bug.cgi?id=24755 - http://lists.suse.com/pipermail/sle-security-updates/2019-April/005314.html - https://www.cve.org/CVERecord?id=CVE-2018-8019 - https://www.cve.org/CVERecord?id=CVE-2018-8020 SRPMS: - 6/core/tomcat-native-1.2.18-1.mga6 . Enhanced tomcat-native libraries address SSL certificate management problem for Mageia 6. Patch issued on May 19, 2019.. Tomcat Native, Mageia Security, Client Certificate, TLS Authentication. . LinuxSecurity.com Team

May 19, 2019 Mageia