Issue #15561 has been updated by Poul H. Sørensen.
We just got bit by this, when we tried to use officially signed certificates ourselves. I think that this issue actual consists of (at least) two problems. I have full understanding for the problems that occur due to using the certname as (part of) filename, but I think that the problems that arise from this, is important to solve (in a not too distant release). <ul> <li> problem №1:<br/> Puppet support for signing using own (non-puppet) certificates. This is needed when using several seperate puppet-cert servers, and moving the puppet client from one cert-server to another. I guess that there also exists other situations, where one may wan to use own certificates. </li> <li> problem №2:<br/> Puppet support for IDN's (Internationalized domain names) (default value of puppetcert is FQDN). </li> </ul> ---------------------------------------- Bug #15561: Fix for CVE-2012-3867 is too restrictive https://projects.puppetlabs.com/issues/15561#change-87161 * Author: Dustin Mitchell * Status: Accepted * Priority: Urgent * Assignee: * Category: SSL * Target version: * Affected Puppet version: 2.7.18 * Keywords: certificate * Branch: https://github.com/puppetlabs/puppet/pull/1101 ---------------------------------------- The fix for CVE-2012-3867 involves checking certificate subjects for "weird" characters. From my read of the CVE entry, this is to filter out characters that would cause the name to display in a manner visually indistinguishable from a valid hostname. However, the check is too restrictive: Could not retrieve catalog from remote server: Certname "puppetagain base ca/[email protected]/ou=release engineering/o=mozilla, inc." must not contain unprintable or non-ASCII characters In particular, / is a very common character in subjects, and should be allowed. Puppet is seeing this subject on my base CA - I'm using certificate chaining. The fix is one character, so I haven't included a patch, but I'm happy to make a pull req if necessary. Another fix would be to only verify certificate subjects for the leaf certificate, and not any of the certs in its signing chain, but that seems less secure. It's also worth noting that the regex is overly broad, since it downcases the string, then accepts A-Z among other characters. -- You have received this notification because you have either subscribed to it, or are involved in it. To change your notification preferences, please click here: http://projects.puppetlabs.com/my/account -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at http://groups.google.com/group/puppet-bugs?hl=en. For more options, visit https://groups.google.com/groups/opt_out.
