PT-2018-4021 · Gnutls · Mod-Gnutls

Vasyl Kaigorodov · Publicado 2018-02-03 · Atualizado 2018-03-13 · CVE-2009-5144

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions mod-gnutls (affected versions not specified)

Description The issue concerns the validation of client certificates. When "GnuTLSClientVerify require" is set in a directory context, mod-gnutls fails to validate client certificates, allowing remote attackers to spoof clients by using a crafted certificate.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

CVE-2009-5144

Produtos afetados

Mod-Gnutls

Referências · 5

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=578663 · Correção
• https://bugzilla.redhat.com/show_bug.cgi?id=1197127 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2009-5144 · Nota de Segurança
• http://issues.outoforder.cc/view.php?id=93 · Nota
• http://openwall.com/lists/oss-security/2015/02/26/6 · Nota