CVE-2015-8400, openSUSE Only.

via oss-security


    https://github.com/shellinabox/shellinabox/issues/355


As far as we can tell, "Stephen Roettger from the Google Security Team
reported to us" means that the report was sent to you in your role as
a maintainer of usbarmory, not in anyone's role as a maintainer of
shellinabox. The case for considering this a shellinabox vulnerability
report (rather than a shellinabox improvement suggestion) may be
marginal.

We decided to assign CVE-2015-8400 for a vulnerability in shellinabox.
This same CVE ID can be used by anyone (such as usbarmory) who makes a
security announcement in direct response to the vulnerability,
regardless of whether the announcement is about removing the package
or changing the package.

The basic rationale is that 'allows HTTP fallback, even when
configured for HTTPS, via the "/plain" URL' is apparently undocumented
(and has the stated security risk). If there had been something in
https://github.com/shellinabox/shellinabox/wiki/shellinaboxd_man or
even a source-code comment saying why the behavior had been chosen
despite the risk, the outcome may have been different. There are
various other choices in shellinaboxd that may seem unusual to people
unfamiliar with the product's use cases, e.g.,

  Unless SSL certificates can be found in the current directory, the
  daemon will automatically generate suitable self-signed
  certificates. ... the use of auto-generated self-signed certificates
  is intended for testing or in intranet deployments

(Someone could conceivably argue that "automatically generate" should
not be a default behavior.)



References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8400
http://seclists.org/oss-sec/2015/q4/418