CVE-2014-0092

lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate...

CVE-2014-0092

lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate...

CVE-2014-1959

lib/x509/verify.c in GnuTLS before 3.1.21 and 3.2.x before 3.2.11 treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates...

CVE-2014-1959

GnuTLS CVE-2014-1959 affects lib/x509/verify.c where an X.509 Version 1 certificate is erroneously treated as an intermediate CA. This allows remote attackers who have a trusted V1 cert to issue new certificates, bypassing certain restrictions. Affected are GnuTLS releases prior to 3.1.21 and 3.2...

CVE-2009-5138

GnuTLS before 2.7.6 is vulnerable when GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT is not enabled: X.509 v1 certificates may be treated as intermediate CAs, allowing a remote attacker to issue new certificates. Affected: GnuTLS library (pre-2.7.6). Remediation: upgrade to 2.7.6 or newer (per the CVE descr...

CVE-2014-0092

GnuTLS CVE-2014-0092 affects lib/x509/verify.c: vulnerable in GnuTLS releases before 3.1.22 and before 3.2.12 (3.2.x). The flaw arises from improper handling of unspecified errors during X.509 certificate verification from SSL servers, enabling MITM via a crafted certificate. Public references co...

CVE-2009-5138

GnuTLS before 2.7.6, when the GNUTLSVERIFYALLOWX509V1CACRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates, a different...

[SECURITY] Fedora 20 Update: gnutls-3.1.20-4.fc20

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, OpenPGP and...

[SECURITY] Fedora 19 Update: gnutls-3.1.20-4.fc19

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, OpenPGP and...

Important: gnutls

Issue Overview: It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a specially crafted certificate that could ...

gnutls: fixed SSL certificate validation (critical)

The gnutls library was updated to fix SSL certificate validation. Remote man-in-the-middle attackers were able to make the verification believe that a SSL certificate is valid even though it was not...

GnuTLS Goto Bug Different from Apple Goto Fail Bug

The similarities between the GnuTLS bug and Apple’s goto fail bug begin and end at their respective failure to verify TLS and SSL certificates. Otherwise, they’re neither siblings, nor distant cousins. The GnuTLS bug is very different, though like Apple’s infamous goto fail error, it will also...

gnutls: fixed SSL certificate validation problems (critical)

The gnutls library was updated to fixed x509 certificate validation problems, where man-in-the-middle attackers could hijack SSL connections. This update also reenables Elliptic Curve support to meet current day cryptographic requirements...

GnuTLS Releases Security Update

GnuTLS has released security updates to address a vulnerability affecting certificate verification functions. An attacker could use a specially crafted X509 certificate to bypass validation checks, impersonate legitimate web sites or services, and perform man-in-the-middle attacks. Many Linux...

FreeBSD : gnutls -- multiple certificate verification issues (f645aa90-a3e8-11e3-a422-3c970e169bc2)

GnuTLS project reports : A vulnerability was discovered that affects the certificate verification functions of all gnutls versions. A specially crafted certificate could bypass certificate validation checks. The vulnerability was discovered during an audit of GnuTLS for Red Hat. Suman Jana report...

CentOS 6 : gnutls (CESA-2014:0246)

Updated gnutls packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CentOS 5 : gnutls (CESA-2014:0247)

Updated gnutls packages that fix two security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

GnuTLS证书验证安全限制绕过漏洞

BUGTRAQ ID: 65919 CVECAN ID: CVE-2014-0092 GnuTLS是用于实现TLS加密协议的函数库。 GnuTLS 3.1.22, 3.2.12之前版本在实现上存在安全漏洞，X.509证书验证的错误处理不正确，可将故障证书标记为有效证书，这可使远程用户利用此漏洞绕过证书验证。 0 GnuTLS GnuTLS 3.2.12 GnuTLS GnuTLS 3.1.22 厂商补丁： GnuTLS ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://gnutls.org...

Check Point response to GnuTLS certificate verification vulnerability (CVE-2014-0092)

...

gnutls security update

CentOS Errata and Security Advisory CESA-2014:0246 Updated gnutls packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base...