Описание
lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | mingw32-gnutls | Will not fix | ||
| Red Hat Enterprise Linux 7 | gnutls | Not affected | ||
| Red Hat Enterprise Linux Extended Update Support 5.3 | gnutls | Affected | ||
| Red Hat Enterprise Linux Extended Update Support 5.6 | gnutls | Affected | ||
| Red Hat Enterprise Linux 4 Extended Lifecycle Support | gnutls | Fixed | RHSA-2014:0288 | 12.03.2014 |
| Red Hat Enterprise Linux 5 | gnutls | Fixed | RHSA-2014:0247 | 03.03.2014 |
| Red Hat Enterprise Linux 5.3 Long Life | gnutls | Fixed | RHSA-2014:0288 | 12.03.2014 |
| Red Hat Enterprise Linux 5.6 Long Life | gnutls | Fixed | RHSA-2014:0288 | 12.03.2014 |
| Red Hat Enterprise Linux 5.9 Extended Update Support | gnutls | Fixed | RHSA-2014:0288 | 12.03.2014 |
| Red Hat Enterprise Linux 6 | gnutls | Fixed | RHSA-2014:0246 | 03.03.2014 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.8 Medium
CVSS2
Связанные уязвимости
lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does ...
lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
EPSS
5.8 Medium
CVSS2