CVE-2009-5144

Опубликовано: 03 фев. 2018

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

mod-gnutls does not validate client certificates when "GnuTLSClientVerify require" is set in a directory context, which allows remote attackers to spoof clients via a crafted certificate.

Ссылки

http://issues.outoforder.cc/view.php?id=93
Broken Link
http://www.openwall.com/lists/oss-security/2015/02/26/6
Issue Tracking
Mailing List
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=578663
Issue Tracking
Mailing List
Patch
https://bugzilla.redhat.com/show_bug.cgi?id=1197127
Issue Tracking
Patch
http://issues.outoforder.cc/view.php?id=93
Broken Link
http://www.openwall.com/lists/oss-security/2015/02/26/6
Issue Tracking
Mailing List
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=578663
Issue Tracking
Mailing List
Patch
https://bugzilla.redhat.com/show_bug.cgi?id=1197127
Issue Tracking
Patch

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:mod_gnutls_project:mod_gnutls:-:*:*:*:*:*:*:*

EPSS

Процентиль: 38%

0.00163

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-254

Связанные уязвимости

CVE-2009-5144

CVSS3: 7.5

ubuntu

почти 8 лет назад

mod-gnutls does not validate client certificates when "GnuTLSClientVerify require" is set in a directory context, which allows remote attackers to spoof clients via a crafted certificate.

CVE-2009-5144

CVSS3: 7.5

debian

почти 8 лет назад

mod-gnutls does not validate client certificates when "GnuTLSClientVer ...

GHSA-8pjf-mf88-ccv8

CVSS3: 7.5

github

больше 3 лет назад

mod-gnutls does not validate client certificates when "GnuTLSClientVerify require" is set in a directory context, which allows remote attackers to spoof clients via a crafted certificate.

EPSS

Процентиль: 38%

0.00163

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-254