Erlang OTP public_key module pkix_verify_hostname certificate validation bypass fix

Vulnerability Overview This vulnerability affects the function in the module. Specifically, the function fails to correctly verify the match between the hostname and the Common Name (CN) or Subject Alternative Name (SAN) in the certificate when processing the field. This flaw could potentially lead to Man-in-the-Middle (MITM) attacks, allowing attackers to forge certificates and steal sensitive information. Scope of Impact Affected Module: Affected Function: Affected Versions: OTP-29.0.1 and OTP-28.5.0.1 Remediation 1. Code Modifications: - Modifications were made to the function in the file to ensure that the and fields in the are correctly checked during hostname verification. - Specific changes include: - Adding validation logic for and . - Ensuring correct matching of the hostname against the Common Name or Subject Alternative Name in the certificate during the verification process. 2. Test Cases: - Multiple test cases were added to the file to verify that the patched function handles various scenarios correctly, including: - Verifying hostname matches against the Common Name in the certificate. - Verifying hostname matches against the Subject Alternative Name in the certificate. - Verifying hostname matches against wildcard names in the certificate. - Verifying hostname matches against IP addresses in the certificate. POC Code Below is a key code snippet of the patched function: ```erlang pkix_verify_hostname(Cert, [uri_id, "https://example.org"]) -> false = public_key:pkix_verify_hostname(Cert, [{dns_id, "foo.EXAMPLE.com"}]), {dns_id, "foo.EXAMPLE.com"} -> false = public_key:pkix_verify_hostname(Cert, [{dns_id, "a.foo.EXAMPLE.com"}]), {dns_id, "a.foo.EXAMPLE.com"} -> false = public_key:pkix_verify_hostname(Cert, [{dns_id, "https://example.org"}]), {dns_id, "https://example.org"} -> false = public_key:pkix_verify_hostname(Cert, [{dns_id, "ab.example.org"}]), {dns_id, "ab.example.org"} -> false = public_key:pkix_verify_hostname(Cert, [{dns_id, "abc.bar.EXAMPLE.com"}]), {dns_id, "abc.bar.EXAMPLE.com"} -> false = public_key:pkix_verify_hostname(Cert, [{dns_id, "https://ab.bar.EXAMPLE.com"}]), {dns_id, "https://ab.bar.EXAMPLE.com"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "erlang.org"}]), {dns_id, "erlang.org"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "ab.example.org"}]), {dns_id, "ab.example.org"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "https://www.example.org"}]), {dns_id, "https://www.example.org"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "www.example.org"}]), {dns_id, "www.example.org"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "example.com"}]), {dns_id, "example.com"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "ab.example.org"}]), {dns_id, "ab.example.org"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "https://www.example.org"}]), {dns_id, "https://www.example.org"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "www.example.org"}]), {dns_id, "www.example.org"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "example.com"}]), {dns_id, "example.com"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "ab.example.org"}]), {dns_id, "ab.example.org"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "https://www.example.org"}]), {dns_id, "https://www.example.org"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "www.example.org"}]), {dns_id, "www.example.org"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "example.com"}]), {dns_id, "example.com"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "ab.example.org"}]), {dns_id, "ab.example.org"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "https://www.example.org"}]), {dns_id, "https://www.example.org"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "www.example.org"}]), {dns_id, "www.example.org"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "example.com"}]), {dns_id, "example.com"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "ab.example.org"}]), {dns_id, "ab.example.org"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "https://www.example.org"}]), {dns_id, "https://www.example.org"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "www.example.org"}]), {dns_id, "www.example.org"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "example.com"}]), {dns_id, "example.com"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "ab.example.org"}]), {dns_id, "ab.example.org"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "https://www.example.org"}]), {dns_id, "https://www.example.org"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "www.example.org"}]), {dns_id, "www.example.org"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "example.com"}]), {dns_id, "example.com"} -> true = public_key:pkix_verify_hostname(Cert, [{dns_id, "ab.example.org"}]), {dns_id, "ab.example.org

Goal Reached Thanks to every supporter — we hit 100%!

Erlang OTP public_key module pkix_verify_hostname certificate validation bypass fix

More from this source