CVE-2008-4989

MEDIUM

Gnutls < 2.6.1 - Improper Certificate Validation

Title source: rule

Description

The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).

References (30)

[Broken Link, Patch] http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3215

[Broken Link] http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html

[Broken Link, Vendor Advisory] http://secunia.com/advisories/32619

[Broken Link] http://secunia.com/advisories/32681

[Broken Link] http://secunia.com/advisories/32687

[Broken Link] http://secunia.com/advisories/32879

[Broken Link] http://secunia.com/advisories/33501

[Broken Link] http://secunia.com/advisories/33694

[Broken Link] http://secunia.com/advisories/35423

[Third Party Advisory] http://security.gentoo.org/glsa/glsa-200901-10.xml

[Broken Link] http://sunsolve.sun.com/search/document.do?assetkey=1-26-260528-1

[Broken Link] http://wiki.rpath.com/Advisories:rPSA-2008-0322

[Mailing List] http://www.debian.org/security/2009/dsa-1719

[Product] http://www.gnu.org/software/gnutls/security.html

[Broken Link] http://www.mandriva.com/security/advisories?name=MDVSA-2008:227

[Broken Link] http://www.redhat.com/support/errata/RHSA-2008-0982.html

[Broken Link, Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/498431/100/0/threaded

[Broken Link, Patch, Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/32232

... and 10 more

Scores

CVSS v3 5.9

EPSS 0.0039

EPSS Percentile 59.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Classification

CWE

CWE-295

Status draft

Affected Products (13)

gnu/gnutls < 2.6.1

fedoraproject/fedora

fedoraproject/fedora

canonical/ubuntu_linux

canonical/ubuntu_linux

canonical/ubuntu_linux

canonical/ubuntu_linux

debian/debian_linux

opensuse/opensuse < 11.1

suse/linux_enterprise

suse/linux_enterprise

suse/linux_enterprise_server

suse/linux_enterprise_server

Timeline

Published Nov 13, 2008

Tracked Since Feb 18, 2026