SB2024103142 - Certificate revocation failure in FreeBSD fetch
Published: October 31, 2024
Security Bulletin ID
SB2024103142
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper Check for Certificate Revocation (CVE-ID: CVE-2024-45289)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to an error in fetch(1) when handling certificate revocation file passed via the "--crl" option. The environment variable name used by fetch(1) to pass the filename to the library was incorrect, in effect ignoring the option. As a result, the library will still connect to a host presenting a certificate that was included into the revocation list.
Remediation
Install update from vendor's website.