CVE-2015-0282

2015-03-2417:59:00

Debian Security Bug Tracker

security-tracker.debian.org

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.005 Low

EPSS

Percentile

75.3%

JSON

GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors.

OSVersionArchitecturePackageVersionFilename
Debian12allgnutls28< 3.7.9-2+deb12u2gnutls28_3.7.9-2+deb12u2_all.deb
Debian11allgnutls28< 3.7.1-5+deb11u4gnutls28_3.7.1-5+deb11u4_all.deb
Debian10allgnutls28< 3.6.7-4+deb10u8gnutls28_3.6.7-4+deb10u8_all.deb
Debian999allgnutls28< 3.8.5-2gnutls28_3.8.5-2_all.deb
Debian13allgnutls28< 3.8.5-2gnutls28_3.8.5-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	gnutls28	< 3.7.9-2+deb12u2	gnutls28_3.7.9-2+deb12u2_all.deb
Debian	11	all	gnutls28	< 3.7.1-5+deb11u4	gnutls28_3.7.1-5+deb11u4_all.deb
Debian	10	all	gnutls28	< 3.6.7-4+deb10u8	gnutls28_3.6.7-4+deb10u8_all.deb
Debian	999	all	gnutls28	< 3.8.5-2	gnutls28_3.8.5-2_all.deb
Debian	13	all	gnutls28	< 3.8.5-2	gnutls28_3.8.5-2_all.deb