GLSA-200901-10 : GnuTLS: Certificate validation error

The remote host is affected by the vulnerability described in GLSA-200901-10 GnuTLS: Certificate validation error Martin von Gagern reported that the gnutlsx509verifycertificate function in lib/x509/verify.c trusts certificate chains in which the last certificate is an arbitrary trusted,...

GnuTLS: Certificate validation error

Background GnuTLS is an open-source implementation of TLS 1.0 and SSL 3.0. Description Martin von Gagern reported that the gnutlsx509verifycertificate function in lib/x509/verify.c trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate. Impact A...

USN-678-2: GnuTLS regression

USN-678-1 fixed a vulnerability in GnuTLS. The upstream patch introduced a regression when validating certain certificate chains that would report valid certificates as untrusted. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Martin von Gagern...

openSUSE 10 Security Update : gnutls (gnutls-5844)

gnutls did not properly verify x509 certificate chains. An attacker could exploit that to trick client programs into trusting servers that would normally get rejected CVE-2008-4989. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

USN-678-1: GnuTLS vulnerability

Martin von Gagern discovered that GnuTLS did not properly verify certificate chains when the last certificate in the chain was self-signed. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to view sensitive information. CVE-2008-4989...

[SECURITY] Fedora 10 Update: gnutls-2.4.2-3.fc10

GnuTLS is a project that aims to develop a library which provides a secure layer, over a reliable transport layer. Currently the GnuTLS library implem ents the proposed standards by the IETF's TLS working group...

FreeBSD Ports: gnutls

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: gnutls

The remote host is missing an update to the system as announced in the referenced advisory. VID 45298931-b3bf-11dd-80f8-001cc0377035 OpenVAS Vulnerability Test $ Description: Auto generated from VID 45298931-b3bf-11dd-80f8-001cc0377035 Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD : gnutls -- X.509 certificate chain validation vulnerability (45298931-b3bf-11dd-80f8-001cc0377035)

SecurityFocus reports : GnuTLS is prone to a security-bypass vulnerability because the application fails to properly validate chained X.509 certificates. Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks by impersonating trusted servers. Unsuspecting users m...

Slackware 12.0 / 12.1 / current : gnutls (SSA:2008-320-01)

New gnutls packages are available for Slackware 12.0, 12.1, and -current to correctly fix the certificate chain verification issue that the upgrade to gnutls-2.6.1 attempted to fix. Without this upgrade, processing a certificate chain containing only one self-signed certificate may cause GnuTLS...

[slackware-security] gnutls

New gnutls packages are available for Slackware 12.0, 12.1, and -current to correctly fix the certificate chain verification issue that the upgrade to gnutls-2.6.1 attempted to fix. Without this upgrade, processing a certificate chain containing only one self-signed certificate may cause GnuTLS...

[ MDVSA-2008:227 ] gnutls

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2008:227 http://www.mandriva.com/security/ Package : gnutls Date : November 12, 2008 Affected: 2008.0, 2008.1, 2009.0 Problem Description: Martin von Gagern found a flow in how GnuTLS versions 1.2.4 up until 2.6....

GnuTLS certificates spoofing

Invalid trust chain verification procedure...

CVE-2008-4989

The gnutlsx509verifycertificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguishe...

CVE-2008-4989

The gnutlsx509verifycertificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguishe...

CVE-2008-4989

Summary: CVE-2008-4989 affects the GnuTLS library. The vulnerability lies in _gnutls_x509_verify_certificate in libgnutls/lib/x509/verify.c, where the library can trust a chain whose last certificate is an arbitrary self-signed trusted cert. This allows a man-in-the-middle to spoof a certificate ...

[SECURITY] Fedora 8 Update: gnutls-1.6.3-5.fc8

GnuTLS is a project that aims to develop a library which provides a secure layer, over a reliable transport layer. Currently the GnuTLS library implem ents the proposed standards by the IETF's TLS working group...

[SECURITY] Fedora 9 Update: gnutls-2.0.4-4.fc9

GnuTLS is a project that aims to develop a library which provides a secure layer, over a reliable transport layer. Currently the GnuTLS library implem ents the proposed standards by the IETF's TLS working group...

Fedora 8 : gnutls-1.6.3-5.fc8 (2008-9600)

Tue Nov 11 2008 Tomas Mraz 1.6.3-5 - fix chain verification issue CVE-2008-4989 470079 - Fri Jun 20 2008 Tomas Mraz 1.6.3-4 - backported fix for compression support 451952 - Tue May 20 2008 Tomas Mraz 1.6.3-3 - fix three security issues in gnutls handshake - GNUTLS-SA-2008-1 447461, 447462,...

CVE-2008-4989

The gnutlsx509verifycertificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguishe...