PT-2005-5500 · Puretls · Puretls

Published 2005-12-31 · Updated 2008-09-05 · CVE-2005-4839

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PureTLS versions prior to 0.9b5

Description The issue is related to the parsing of certificates. Specifically, it does not clear optional Extensions and Algorithm.Parameters values before parsing, which might trigger an information leak of values from earlier certificates.

Recommendations For versions prior to 0.9b5, update to version 0.9b5 or later to resolve the issue.

Fix

Related Identifiers

CVE-2005-4839

Affected Products

Puretls

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2005-4839 · Security Note
• http://rtfm.com/puretls · Note
• http://www1.ietf.org/mail-archive/web/tls/current/msg00229.html · Note