PT-2014-1865 · Gnu+4 · Gnutls+4

Published 2014-03-03 · Updated 2024-06-15 · CVE-2014-0092

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GnuTLS versions prior to 3.1.22 GnuTLS versions 3.2.x prior to 3.2.12

Description The issue arises from improper handling of unspecified errors when verifying X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers via a crafted certificate. Exploitation of this vulnerability can lead to a breach of confidentiality, integrity, and availability of protected information and can be carried out remotely.

Recommendations For GnuTLS versions prior to 3.1.22, update to version 3.1.22 or later. For GnuTLS versions 3.2.x prior to 3.2.12, update to version 3.2.12 or later. As a temporary workaround, consider restricting the use of X.509 certificate verification until a patch is available.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

ALT-PU-2014-1263

BDU:2015-07241

BDU:2015-07246

BDU:2015-07249

BDU:2015-07253

BDU:2015-09761

CESA-2014_0246

CVE-2014-0092

DSA-2869-1

MGASA-2014-0117

OPENSUSE-SU-2014_0325-1

OPENSUSE-SU-2014_0328-1

OPENSUSE-SU-2014_0346-1

OPENSUSE-SU-2024:10105-1

RHSA-2014:0246

RHSA-2014:0247

RHSA-2014:0288

RHSA-2014:0339

RHSA-2014_0246

RHSA-2014_0247

SUSE-SU-2014_0321-1

SUSE-SU-2014_0323-1

SUSE-SU-2015:0675-1

USN-2127-1

Affected Products

Alt Linux

Centos

Gnutls

Red Hat

Suse

References · 89

• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00004.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0092 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0092 · Vendor Advisory
• http://debian.org/security/2014/dsa-2869 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0092 · Vendor Advisory
• http://secunia.com/advisories/57204 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00006.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07253 · Security Note
• https://linux.oracle.com/errata/ELSA-2014-0246.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0092 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1959 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-0092 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0117 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2116 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-0246.html · Vendor Advisory