Vulnerability Description
systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there is no hostname validation with the GnuTLS backend. NOTE: This has been disputed by the developer as not a vulnerability since hostname validation does not have anything to do with this issue (i.e. there is no hostname to be sent)
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Systemd Project | Systemd | >= 239, < 244 |
| Fedoraproject | Fedora | 31 |
Related Weaknesses (CWE)
References
- https://blog.cloudflare.com/dns-encryption-explained/Third Party Advisory
- https://github.com/systemd/systemd/blob/v239/man/resolved.conf.xml#L199-L207ExploitThird Party Advisory
- https://github.com/systemd/systemd/blob/v243/man/resolved.conf.xml#L196-L207ExploitThird Party Advisory
- https://github.com/systemd/systemd/blob/v243/src/resolve/resolved-dnstls-gnutls.PatchThird Party Advisory
- https://github.com/systemd/systemd/issues/9397Issue TrackingThird Party Advisory
- https://github.com/systemd/systemd/pull/13870PatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.netapp.com/advisory/ntap-20191122-0002/Third Party Advisory
- https://tools.ietf.org/html/rfc7858#section-4.1Third Party Advisory
- https://blog.cloudflare.com/dns-encryption-explained/Third Party Advisory
- https://github.com/systemd/systemd/blob/v239/man/resolved.conf.xml#L199-L207ExploitThird Party Advisory
- https://github.com/systemd/systemd/blob/v243/man/resolved.conf.xml#L196-L207ExploitThird Party Advisory
- https://github.com/systemd/systemd/blob/v243/src/resolve/resolved-dnstls-gnutls.PatchThird Party Advisory
- https://github.com/systemd/systemd/issues/9397Issue TrackingThird Party Advisory
- https://github.com/systemd/systemd/pull/13870PatchThird Party Advisory
FAQ
What is CVE-2018-21029?
CVE-2018-21029 is a vulnerability with a CVSS score of 9.8 (CRITICAL). systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there is no hostname validation with the GnuTL...
How severe is CVE-2018-21029?
CVE-2018-21029 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2018-21029?
Check the references section above for vendor advisories and patch information. Affected products include: Systemd Project Systemd, Fedoraproject Fedora.