Issue #15561 has been updated by Dustin Mitchell.
(bringing the convo back here from the pull req) dpittman: > @jeffmccune is the last person I know who looked at this, but because of some > horrible internal deficiencies allowing / will actually break various parts > of the certificate handling. Which is kind of awful. dustin: > They work in 2.7.17.. dpittman > They *partially* work in 2.7.17: you can load the certificate, but you can't > enumerate it. Which leads to some issues at times. This bug is presently blocking me from upgrading past 2.7.17, which is disconcerting since 2.7.18 is a security-fix release. So if it's hard to go forward and fix the /-handling problems, can we at least go back to how it was in 2.7.17? Alternately, can you point me to some more information about the problems stemming from the /, and I'll see if I can find a fix? ---------------------------------------- Bug #15561: Fix for CVE-2012-3867 is too restrictive https://projects.puppetlabs.com/issues/15561#change-70431 Author: Dustin Mitchell Status: In Topic Branch Pending Review Priority: Normal Assignee: Dustin Mitchell Category: SSL Target version: 2.7.x Affected Puppet version: 2.7.18 Keywords: certificate Branch: https://github.com/puppetlabs/puppet/pull/1101 The fix for CVE-2012-3867 involves checking certificate subjects for "weird" characters. From my read of the CVE entry, this is to filter out characters that would cause the name to display in a manner visually indistinguishable from a valid hostname. However, the check is too restrictive: Could not retrieve catalog from remote server: Certname "puppetagain base ca/[email protected]/ou=release engineering/o=mozilla, inc." must not contain unprintable or non-ASCII characters In particular, / is a very common character in subjects, and should be allowed. Puppet is seeing this subject on my base CA - I'm using certificate chaining. The fix is one character, so I haven't included a patch, but I'm happy to make a pull req if necessary. Another fix would be to only verify certificate subjects for the leaf certificate, and not any of the certs in its signing chain, but that seems less secure. It's also worth noting that the regex is overly broad, since it downcases the string, then accepts A-Z among other characters. -- You have received this notification because you have either subscribed to it, or are involved in it. To change your notification preferences, please click here: http://projects.puppetlabs.com/my/account -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/puppet-bugs?hl=en.
