OpenSSL - TLS 1.2 Protocol MD5 Hash Function Collision Attack
Summary
DSA-3436-1: openssl - security update. Affects openssl versions < 1.0.1e-2+deb7u19. Fixed in 1.0.1e-2+deb7u19. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is an open-source implementation of the SSL and TLS protocols, widely used for secure communication over computer networks. It provides cryptographic functions and supports various protocols, including TLS 1.2. The TLS 1.2 protocol is used for establishing secure connections between clients and servers. However, a vulnerability has been discovered in the TLS 1.2 protocol implementation of OpenSSL.
Vulnerability Detail
The vulnerability in OpenSSL's TLS 1.2 protocol allows the use of the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. This flaw enables a man-in-the-middle attacker to exploit collision attacks, potentially impersonating a TLS server or an authenticated TLS client. The vulnerability poses a significant security risk as it compromises the integrity and authenticity of the TLS communication.
How To Fix
Minimum fixed version
1.0.1e-2+deb7u19
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the OpenSSL packages to the patched versions.
Conclusion
The OpenSSL TLS 1.2 Protocol MD5 Hash Function Collision Attack vulnerability allows an attacker to impersonate a TLS server or an authenticated TLS client. To mitigate this vulnerability, it is crucial to upgrade the OpenSSL packages to the patched versions mentioned in the 'how_to_fix' section. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for openssl →
FAQ
The vulnerability allows a man-in-the-middle attacker to impersonate a TLS server or an authenticated TLS client, compromising the security and integrity of the TLS communication.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
No, only versions prior to the patched versions mentioned in the 'how_to_fix' section are affected. It is crucial to upgrade to the recommended versions to mitigate the vulnerability.
No, there is no known workaround. Upgrading to the patched versions is the only solution to address this vulnerability.
You can find more information about this vulnerability at https://www.mitls.org/pages/attacks/SLOTH.
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
