1769000 - (CVE-2023-0430) Message signed with revoked S/MIME certificate shown as correctly signed

Status: RESOLVED FIXED

(MailNews Core :: Security: S/MIME, defect)

Description

[Paul Menzel]

Steps to reproduce:

Use Debian sid/unstable with thunderbird 1:91.8.1-1, and view a message signed with a revoked S/MIME certificate.

Actual results:

The message is displayed a correctly signed despite the certificate being revoked.

Expected results:

The message should be shown as incorrectly signed.

$ openssl ocsp -issuer x-chain.pem -issuer GEANT_Personal_CA_4.pem -cert x.pem -url http://GEANT.ocsp.sectigo.com
WARNING: no nonce in response
Response verify OK
x.pem: revoked
	This Update: May  9 04:30:28 2022 GMT
	Next Update: May 16 04:30:28 2022 GMT
	Revocation Time: Dec  7 11:21:35 2021 GMT

Comment 1

[Paul Menzel]

Any hints how to debug this by setting some environment variables?

Comment 2

[Wayne Mery (:wsmwk)]

(In reply to Paul Menzel from comment #1)

Any hints how to debug this by setting some environment variables?

Comment 3

[Kai Engert (:KaiE:)]

I haven't seen this report earlier, sorry.

I'd consider this a serious bug.

I would need to see an example where the signing certificate hasn't expired yet, but has been revoked.
I'm afraid that the signing certificate from your example has expired in the meantime?

Comment 4

[Paul Menzel]

I would have hoped there are publicly available test certificates to test this.

Anyway, the certificate is actually still valid. If you send me an email with your S/MIME certificate, and can make that message available to you.

Comment 5

[Kai Engert (:KaiE:)]

Paul, thanks, I am able to confirm the bug.
I'm currently evaluating the best way to fix it.

Comment 6

[Kai Engert (:KaiE:)]

Attachment: Bug 1769000 - Re-enable OCSP checking when verifying S/MIME signature certificate. r=darktrojan

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/77d11965ebbb
Re-enable OCSP checking when verifying S/MIME signature certificate. r=darktrojan

Comment 8

[Paul Menzel]

Thank you for the fix. Some questions:

1. As there is no elaborate commit message, could you please elaborate here, which commit disabled OCSP checking, so it’s clear in what version the problem was introduced?
2. Is this a security issue? If there is a security team, does it need to be contacted to coordinate backporting this? Does a CVE need to be assigned?

Comment 9

[Kai Engert (:KaiE:)]

Yes, I consider it a security issue, we intend to backport it to the esr102 branch soon, and will issue a CVE.

Comment 10

[Kai Engert (:KaiE:)]

Tom, can you please assign a CVE?

Comment 11

[Kai Engert (:KaiE:)]

The regression was apparently caused by bug 1500003.
The first release with this regression was version 68.0

Comment 12

[Kai Engert (:KaiE:)]

Given that comm-central is currently in an instable state (after the "ash" repository merge), I suggest that we uplift this immediately to beta for testing. I think the code should be safe for comm-esr102, too.

Comment 13

[Kai Engert (:KaiE:)]

Comment on attachment 9313158 [details]
Bug 1769000 - Re-enable OCSP checking when verifying S/MIME signature certificate. r=darktrojan

[Approval Request Comment]
Regression caused by (bug #): bug 1500003
User impact if declined: wrong digital signature security status for messages that were signed using a revoked S/MIME certificate
Testing completed (on c-c, etc.): Manually. We have no automated tests covering requests to live OCSP servers.
Risk to taking this patch (and alternatives if risky): I think it's low. In a debug build, the worst is a controlled deliberate crash. In an optimized build, the use of the incorrect (main) thread will be detected (in mozilla::pkix::Result DoOCSPRequest) and an error "cannot perform OCSP" will be returned - that's the same level of today's not attempting OCSP, which means the patch cannot make things worse in an optimized build, IMO.

Comment 14

[Wayne Mery (:wsmwk)]

Comment on attachment 9313158 [details]
Bug 1769000 - Re-enable OCSP checking when verifying S/MIME signature certificate. r=darktrojan

[Triage Comment]
Approved for beta
Approved for esr102, pending beta release

Comment 15

[Daniel Darnell [:dandarnell]]

Thunderbird 110.0b2:
https://hg.mozilla.org/releases/comm-beta/rev/b331a1207eca

Comment 16

[Daniel Darnell [:dandarnell]]

Thunderbird 102.7.1:
https://hg.mozilla.org/releases/comm-esr102/rev/4ef99bd248ad

Comment 17

[Paul Menzel]

Thank you, it works correctly with Mozilla Thunderbird 102.7.1:

This message includes a digital signature, but the signature is invalid.

The certificate used to sign the message was issued by a certificate authority that you do not trust for issuing this kind of certificate.

German:

Diese Nachricht enthält eine digitale Unterschrift, aber die Unterschrift ist ungültig.

Das Zertifikat, das zum Unterschreiben der Nachricht verwendet wurde, wurde von einer Zertifizierungsstelle herausgegeben, der Sie für diese Art von Zertifikaten nicht vertrauen.

Thank you for all involved.

(I created bug 1812295 1 regarding the message, which could be more specific.)