PT-2015-5598 · Gnutls · Mod-Gnutls

Thomas Klute · Publicado 2015-03-10 · Atualizado 2017-09-19 · CVE-2015-2091

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions mod-gnutls versions 0.5.10 and earlier

Description The issue concerns the authentication hook in mod-gnutls, which fails to validate client certificates under certain conditions, allowing remote attackers to spoof clients by using a crafted certificate.

Recommendations For mod-gnutls versions 0.5.10 and earlier, consider updating to a version where this issue is fixed, as the current version does not properly validate client certificates when "GnuTLSClientVerify require" is set. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2015-2091

DLA-170-1

DSA-3177-1

Produtos afetados

Mod-Gnutls

Referências · 10

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=578663 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-2091 · Nota de Segurança
• https://osv.dev/vulnerability/DSA-3177-1 · Aviso do Fabricante
• http://debian.org/security/2015/dsa-3177 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/mod-gnutls · Aviso do Fabricante
• https://security.gentoo.org/glsa/201709-04 · Aviso do Fabricante
• http://issues.outoforder.cc/view.php?id=93 · Aviso do Fabricante
• https://packages.debian.org/src:mod-gnutls · Nota
• https://security-tracker.debian.org/tracker/DSA-3177-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2091 · Nota de Segurança