Hello and welcome to the Wednesday, November 2, 2020 edition of the Sansonet Stormer's

Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Well, of course, the bulk of today's podcast will be dedicated to the patch released for OpenSSL, even though it turned

out to be not quite as bad as people, including myself, anticipated when it was pre-announced.

It was pre-announced as a critical vulnerability, but then what was actually released was only rated as high.

The reason behind this is that yes, potentially this vulnerability could be used for remote code execution,

which of course typically rates it critical, but it does require some fairly specific preconditions and also is unlikely to be

exploitable on most common platforms. I will link in the show notes to a blog post by OpenSL

that has a couple more details about the downgrading from critical to high. So let's talk a little bit about

this vulnerability. It does affect certificates that contain domain names that are using

international characters. In domain names, international characters are typically encoded as puny code,

and that's the representation of domain names that you find in certificates, which could happen

as like a subject alternate name, where you typically find host names, sort of in server

certificates, but it could also occur in

email addresses. Now, there are actually two CVEs, so two distinct vulnerabilities, CVE2

CVE 2020-3602 and CVE 2022-3786, but the vulnerabilities are very closely related. They're both related to this

puny code issue. In so far, I'll treat more or less here as a one vulnerability. The first

one being the one that was originally rated as critical, it does allow a 4-byte buffer overflow if an

invalid puny code string is being parsed, but this only happens if the certificate first passes

the certificate validation, so it has to be signed with a trusted certificate authority.

Now, typically, certificates are really only validated by clients.

If a client connects to a server, the certificate is sent from the server to the client,

...