aqbanking wizard in GNUCash doesn't support SNI

[Luke Faraone]

1. Start new GNUCash
2. Online banking wizard
3. OFX backend
4. Select bank: USAA (FID 24591)

Auto-populates API url of https://service2.usaa.com/ofx/OFXServlet

"Request account list" and enter a bogus pin.

What happens:
The user gets a SSL error about a mismatch between the certificate expected and the presented certificate's hostname of www.usaa.com.

Since visiting the API url in a browser works correctly, and I see that services2.dropbox.com and www.usaa.com resolve to the same IP, I suspect this is due to a lack of SNI support in GNUCash.

ProblemType: Bug
DistroRelease: Ubuntu 18.04
Package: aqbanking-tools (not installed)
ProcVersionSignature: Ubuntu 4.15.0-39.42-generic 4.15.18
Uname: Linux 4.15.0-39-generic x86_64
NonfreeKernelModules: openafs nvidia_modeset nvidia
ApportVersion: 2.20.9-0ubuntu7.5
Architecture: amd64
CurrentDesktop: GNOME
Date: Fri Dec 7 04:45:23 2018
SourcePackage: libaqbanking
UpgradeStatus: Upgraded to bionic on 2018-05-21 (200 days ago)

[Eduardo Barretto (ebarretto)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Micha Lenk (micha)]

I was able to reproduce this issue using the "USAA Federal Savings Bank" (fid 483). A warning about a certificate mismatch appears.

Some code research in libaqbanking and libgwenhywfar revealed the used libraries indeed don't call the gnutls_server_name_set() function to set the SNI.

[Micha Lenk (micha)]

This should be fixed with libgwenhywfar 5.4.1-1.

I would appreciate if someone could confirm it as fixed.

[Micha Lenk (micha)]

The fixed package libgwenhywfar/5.4.1-1 is available in Groovy Gorilla (current stable release). Changing status to Fix Released.