Lucene search

RedhatCVE-2010-0731

HistoryMar 26, 2010 - 6:30 p.m.

CVE-2010-0731

2010-03-2618:30:00

CWE-119

redhat

web.nvd.nist.gov

cve

gnutls

certificate revocation list

crl

buffer overflow

x.509 certificate

nvd

security vulnerability

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

6.9

Confidence

Low

EPSS

0.032

Percentile

91.3%

JSON

The gnutls_x509_crt_get_serial function in the GnuTLS library before 1.2.1, when running on big-endian, 64-bit platforms, calls the asn1_read_value with a pointer to the wrong data type and the wrong length value, which allows remote attackers to bypass the certificate revocation list (CRL) check and cause a stack-based buffer overflow via a crafted X.509 certificate, related to extraction of a serial number.

Affected configurations

Nvd

Node

gnugnutlsRange≤1.2.0

gnugnutlsMatch1.0.16

gnugnutlsMatch1.0.17

gnugnutlsMatch1.0.18

gnugnutlsMatch1.0.19

gnugnutlsMatch1.0.20

gnugnutlsMatch1.0.21

gnugnutlsMatch1.0.22

gnugnutlsMatch1.0.23

gnugnutlsMatch1.0.24

gnugnutlsMatch1.0.25

gnugnutlsMatch1.1.13

gnugnutlsMatch1.1.14

gnugnutlsMatch1.1.15

gnugnutlsMatch1.1.16

gnugnutlsMatch1.1.17

gnugnutlsMatch1.1.18

gnugnutlsMatch1.1.19

gnugnutlsMatch1.1.20

gnugnutlsMatch1.1.21

gnugnutlsMatch1.1.22

gnugnutlsMatch1.1.23

VendorProductVersionCPE
gnugnutls*cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:*
gnugnutls1.0.16cpe:2.3:a:gnu:gnutls:1.0.16:*:*:*:*:*:*:*
gnugnutls1.0.17cpe:2.3:a:gnu:gnutls:1.0.17:*:*:*:*:*:*:*
gnugnutls1.0.18cpe:2.3:a:gnu:gnutls:1.0.18:*:*:*:*:*:*:*
gnugnutls1.0.19cpe:2.3:a:gnu:gnutls:1.0.19:*:*:*:*:*:*:*
gnugnutls1.0.20cpe:2.3:a:gnu:gnutls:1.0.20:*:*:*:*:*:*:*
gnugnutls1.0.21cpe:2.3:a:gnu:gnutls:1.0.21:*:*:*:*:*:*:*
gnugnutls1.0.22cpe:2.3:a:gnu:gnutls:1.0.22:*:*:*:*:*:*:*
gnugnutls1.0.23cpe:2.3:a:gnu:gnutls:1.0.23:*:*:*:*:*:*:*
gnugnutls1.0.24cpe:2.3:a:gnu:gnutls:1.0.24:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
gnu	gnutls	*	cpe:2.3:a:gnu:gnutls::::::::
gnu	gnutls	1.0.16	cpe:2.3:a:gnu:gnutls:1.0.16:::::::*
gnu	gnutls	1.0.17	cpe:2.3:a:gnu:gnutls:1.0.17:::::::*
gnu	gnutls	1.0.18	cpe:2.3:a:gnu:gnutls:1.0.18:::::::*
gnu	gnutls	1.0.19	cpe:2.3:a:gnu:gnutls:1.0.19:::::::*
gnu	gnutls	1.0.20	cpe:2.3:a:gnu:gnutls:1.0.20:::::::*
gnu	gnutls	1.0.21	cpe:2.3:a:gnu:gnutls:1.0.21:::::::*
gnu	gnutls	1.0.22	cpe:2.3:a:gnu:gnutls:1.0.22:::::::*
gnu	gnutls	1.0.23	cpe:2.3:a:gnu:gnutls:1.0.23:::::::*
gnu	gnutls	1.0.24	cpe:2.3:a:gnu:gnutls:1.0.24:::::::*