CVE-2021-44273: 
Linux Debian vulnerability analysis and mitigation

CVE-2021-44273 affects e2guardian versions 5.4.x up to and including 5.4.3r, specifically when operating in standalone mode with SSL MITM enabled. The vulnerability was discovered in December 2021 and involves missing SSL certificate validation in the SSL MITM engine. When built with OpenSSL v1.1.x, e2guardian failed to validate hostnames in certificates of web servers it connected to (OSS Security, NVD).

The vulnerability occurs when e2guardian is compiled against OpenSSL 1.1.x and operates in standalone mode (as a proxy or transparent proxy). The core issue is that the software did not implement proper certificate hostname validation, allowing connections to servers with mismatched hostnames in their SSL certificates. This was demonstrated through successful connections to domains like wrong.host.badssl.com that should normally be rejected (Github Issue). The vulnerability has been assigned a CVSS v3.1 base score of 7.4 (HIGH) with vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (NVD).

The vulnerability significantly compromises the security of systems it was meant to protect. An attacker positioned between e2guardian and the target web server could perform man-in-the-middle (MITM) attacks by presenting any valid certificate, regardless of the hostname. This could lead to potential interception and manipulation of supposedly secure communications (OSS Security).

The issue has been fixed in the v5.4 branch through a patch that implements proper certificate hostname validation. The fix involves adding X509VERIFYPARAMset1host verification for OpenSSL versions 1.1.0 and above (Github Commit). Systems using OpenSSL 1.0.2 or operating e2guardian as ICAP servers are not affected by this vulnerability (OSS Security).

Security researchers have noted that this vulnerability, along with similar incidents, suggests that requirements to MITM all SSL traffic might actually lower security rather than enhance it. This is because browsers typically have the best available quality of TLS implementations (OSS Security).