CVE-2016-7444

HIGH

GnuTLS < 3.4.15 and 3.5.x < 3.5.4 - Certificate Validation Bypass via OCSP Response Serial Length

Title source: llm

Description

The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc.

References (6)

Core 6

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/92893

Patch x_refsource_confirm

https://gitlab.com/gnutls/gnutls/commit/964632f37dfdfb914ebc5e49db4fa29af35b1de9

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2017:2292

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

https://lists.gnupg.org/pipermail/gnutls-devel/2016-September/008146.html

Vendor Advisory x_refsource_confirm

https://www.gnutls.org/security.html

Scores

CVSS v3 7.5

EPSS 0.0102

EPSS Percentile 77.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-264

Status published

Products (5)

gnu/gnutls 3.5.0

gnu/gnutls 3.5.1

gnu/gnutls 3.5.2

gnu/gnutls 3.5.3

gnu/gnutls < 3.4.14

Published Sep 27, 2016

Tracked Since Feb 18, 2026