Impact
Certificate‑issuer validation gap leading to sender impersonation (CWE‑295).
A Sender Impersonation flaw enables an enrolled participant (i.e. a legitimate user whose certificate is stored in the recipient’s directory) to forge a SECON message that the receiver authenticates as coming from any other participant. The root cause is an inadequate issuer‑validation step that accepts any directory entry as a signing authority, regardless of whether the certificate is a Certificate Authority (CA).
Affected configurations
Affected configurations populate the certificate directory with end-entity (participant) certificates. Deployments using an LDAP directory that holds only certificate-authority certificates are not affected through this path
Patches
Fixed versions: >= 1.2.3
What the fix does
Issuer lookup now rejects any certificate whose BasicConstraints value is not set (i.e. not a CA).
Workarounds
Audit the keystore that secon-tool uses as its directory and remove any non-CA (end-entity) certificates; reserve the keystore for CA certificates and route participant lookup through an LDAP directory.
References
GKV - Anlage 16 -SECON Security Schnittstelle
Machine Spirits Advisory MS-SECON-1f6bd9 https://machinespirits.com/advisory/1f6bd9/
Impact
Certificate‑issuer validation gap leading to sender impersonation (CWE‑295).
A Sender Impersonation flaw enables an enrolled participant (i.e. a legitimate user whose certificate is stored in the recipient’s directory) to forge a SECON message that the receiver authenticates as coming from any other participant. The root cause is an inadequate issuer‑validation step that accepts any directory entry as a signing authority, regardless of whether the certificate is a Certificate Authority (CA).
Affected configurations
Affected configurations populate the certificate directory with end-entity (participant) certificates. Deployments using an LDAP directory that holds only certificate-authority certificates are not affected through this path
Patches
Fixed versions: >= 1.2.3
What the fix does
Issuer lookup now rejects any certificate whose BasicConstraints value is not set (i.e. not a CA).
Workarounds
Audit the keystore that secon-tool uses as its directory and remove any non-CA (end-entity) certificates; reserve the keystore for CA certificates and route participant lookup through an LDAP directory.
References
GKV - Anlage 16 -SECON Security Schnittstelle
Machine Spirits Advisory MS-SECON-1f6bd9 https://machinespirits.com/advisory/1f6bd9/