CVE-2024-13454 - blame None

Blame

c4f02d	Samuli Seppänen	2025-01-29 08:37:37	1	## CVE-2024-13454 - Easy-RSA with OpenSSL 3 may create a CA private key using 3DES
			2
4ecfdf	Samuli Seppänen	2025-02-27 10:14:43	3	Using Easy-RSA after version 3.0.5 and before 3.2.0 on systems using
			4	OpenSSL 3 will incorrectly encrypt password protected CA private keys
			5	using cipher:des-ede3-cbc when using the `easyrsa build-ca` command.
			6	The algorithm expected to be used is cipher:aes-256-cbc.
c4f02d	Samuli Seppänen	2025-01-29 08:37:37	7
4ecfdf	Samuli Seppänen	2025-02-27 10:14:43	8	How to fix the private CA key:
			9	- Use the `easyrsa set-pass ca` command. This will re-encrypt the
			10	private CA key using the proper cipher algorithm. This will work
			11	on all Easy-RSA versions.
c4f02d	Samuli Seppänen	2025-01-29 08:37:37	12
4ecfdf	Samuli Seppänen	2025-02-27 10:14:43	13	Additional recommendation:
c4f02d	Samuli Seppänen	2025-01-29 08:37:37	14	- Upgrade to Easy-RSA version 3.2.0 or newer.
			15
4ecfdf	Samuli Seppänen	2025-02-27 10:14:43	16	Command `set-pass` was introduced in Easy-RSA-3.1.2 (https://github.com/OpenVPN/easy-rsa/pull/756).
			17
			18	Using OpenSSL v3 with each version of Easy-RSA command `build-ca`, then using Easy-RSA command `set-pass ca` to re-encrypt the CA key with a new password:
			19
			20	Note: Easy-RSA support for OpenSSL v3 was first introduced in Easy-RSA `v3.1.0` (https://github.com/OpenVPN/easy-rsa/pull/492).
			21
			22	\| \| \| \|
			23	\|-\|-\|-\|
			24	\| EasyRSA-3.0.5: \| build-ca: des-ede3-cbc - \| set-rsa-pass: aes-256-cbc
			25	\| EasyRSA-3.0.6: \| build-ca: des-ede3-cbc - \| set-rsa-pass: aes-256-cbc
			26	\| EasyRSA-3.0.7: \| build-ca: des-ede3-cbc - \| set-rsa-pass: aes-256-cbc
			27	\| EasyRSA-3.0.8: \| build-ca: des-ede3-cbc - \| set-rsa-pass: aes-256-cbc
			28	\| EasyRSA-3.0.9: \| build-ca: des-ede3-cbc - \| set-rsa-pass: aes-256-cbc
			29	\| EasyRSA-3.1.0: \| build-ca: des-ede3-cbc - \| set-rsa-pass: aes-256-cbc
			30	\| EasyRSA-3.1.1: \| build-ca: des-ede3-cbc - \| set-rsa-pass: aes-256-cbc
			31	\| EasyRSA-3.1.2: \| build-ca: des-ede3-cbc - \| set-pass: aes-256-cbc
			32	\| EasyRSA-3.1.3: \| build-ca: des-ede3-cbc - \| set-pass: aes-256-cbc
			33	\| EasyRSA-3.1.4: \| build-ca: des-ede3-cbc - \| set-pass: aes-256-cbc
			34	\| EasyRSA-3.1.5: \| build-ca: des-ede3-cbc - \| set-pass: aes-256-cbc
			35	\| EasyRSA-3.1.6: \| build-ca: des-ede3-cbc - \| set-pass: aes-256-cbc
			36	\| EasyRSA-3.1.7: \| build-ca: des-ede3-cbc - \| set-pass: aes-256-cbc
			37	\| EasyRSA-3.2.0: \| build-ca: aes-256-cbc - \| set-pass: aes-256-cbc
			38	\| EasyRSA-3.2.1: \| build-ca: aes-256-cbc - \| set-pass: aes-256-cbc
			39
			40	OpenSSL version `1.1.0l` and `1.1.1w` has been tested and no issues were found. OpenSSL 1.x is not expected to have this issue.
			41
			42	However the `set-rsa-pass` and `set-ec-pass` were found to change the CA key format from PKCS12 to PKC8 for Easy-RSA versions `3.0.9` through `3.1.7`. In all cases, the cipher used was `aes-256-cbc`.