Apache mod-gnutls Certificate Spoofing Vulnerability

mod-gnutls is an extension to Apache's httpd which provides HTTPS services through the use of the GnuTLS library from the Apache Software Foundation. A certificate spoofing vulnerability exists in Apache mod-gnutls version 0.5.10 and earlier, which allows remote attackers to spoof clients via a...

[SECURITY] [DSA 3177-1] mod-gnutls security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3177-1 [email protected] http://www.debian.org/security/ Sebastien Delafond March 10, 2015 http://www.debian.org/security/faq -...

[SECURITY] [DLA 170-1] mod-gnutls security update

Package : mod-gnutls Version : 0.5.6-1+squeeze2 CVE ID : CVE-2015-2091 Debian Bug : 578663 Thomas Klute discovered that in mod-gnutls, an Apache module providing SSL and TLS encryption with GnuTLS, a bug caused the servers client verify mode not to be considered at all, in case the directorys...

DLA-170-1 mod-gnutls - security update

Bulletin has no description...

CVE-2015-2091

The authentication hook mgshookauthz in mod-gnutls 0.5.10 and earlier does not validate client certificates when "GnuTLSClientVerify require" is set, which allows remote attackers to spoof clients via a crafted certificate...

CVE-2015-2091

The authentication hook mgshookauthz in mod-gnutls 0.5.10 and earlier does not validate client certificates when "GnuTLSClientVerify require" is set, which allows remote attackers to spoof clients via a crafted certificate...

Authentication flaw

The authentication hook mgshookauthz in mod-gnutls 0.5.10 and earlier does not validate client certificates when "GnuTLSClientVerify require" is set, which allows remote attackers to spoof clients via a crafted certificate...

CVE-2015-2091

The authentication hook mgshookauthz in mod-gnutls 0.5.10 and earlier does not validate client certificates when "GnuTLSClientVerify require" is set, which allows remote attackers to spoof clients via a crafted certificate...

CVE-2015-2091

Summary: CVE-2015-2091 affects mod-gnutls (Apache module) versions = 0.7.3 in the Gentoo advisory). Remediation (supported by sources): upgrade mod-gnutls to patched versions; apply vendor advisories that list updated releases. No exploit details are provided beyond the vulnerability description ...

CVE-2015-2091

The authentication hook mgshookauthz in mod-gnutls 0.5.10 and earlier does not validate client certificates when "GnuTLSClientVerify require" is set, which allows remote attackers to spoof clients via a crafted certificate...

CVE-2015-2091

Removed by vendor...

CVE-2015-2091: Undefined Security Weakness

The authentication hook mgshookauthz in mod-gnutls 0.5.10 and earlier does not validate client certificates when "GnuTLSClientVerify require" is set, which allows remote attackers to spoof clients via a crafted certificate...

Debian DSA-3177-1 : mod-gnutls - security update

Thomas Klute discovered that in mod-gnutls, an Apache module providing SSL and TLS encryption with GnuTLS, a bug caused the server's client verify mode not to be considered at all, in case the directory's configuration was unset. Clients with invalid certificates were then able to leverage this...

[SECURITY] [DSA 3177-1] mod-gnutls security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3177-1 [email protected] http://www.debian.org/security/ Sebastien Delafond March 10, 2015 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3177-1] mod-gnutls security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3177-1 [email protected] http://www.debian.org/security/ Sebastien Delafond March 10, 2015 http://www.debian.org/security/faq -...

USN-2523-1 apache2 vulnerabilities

Martin Holst Swende discovered that the modheaders module allowed HTTP trailers to replace HTTP headers during request processing. A remote attacker could possibly use this issue to bypass RequestHeaders directives. CVE-2013-5704 Mark Montague discovered that the modcache module incorrectly handl...

PT-2015-5598

Name of the Vulnerable Software and Affected Versions mod-gnutls versions 0.5.10 and earlier Description The issue concerns the authentication hook in mod-gnutls, which fails to validate client certificates under certain conditions, allowing remote attackers to spoof clients by using a crafted...

Debian Security Advisory DSA 3177-1 (mod-gnutls - security update)

Thomas Klute discovered that in mod-gnutls, an Apache module providing SSL and TLS encryption with GnuTLS, a bug caused the server OpenVAS Vulnerability Test $Id: deb3177.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3177-1 using nvtgen 1.0 Script version: 1.0 Author:...

DSA-3177-1 mod-gnutls - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3177-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...