PT-2014-1895 · Gnu+1 · Gnutls+1

Published 2014-02-16 · Updated 2024-06-15 · CVE-2014-1959

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GnuTLS versions prior to 3.1.21 GnuTLS versions 3.2.x prior to 3.2.11

Description The issue allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates. This is because GnuTLS treats version 1 X.509 certificates as intermediate CAs. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For GnuTLS versions prior to 3.1.21, update to version 3.1.21 or later. For GnuTLS versions 3.2.x prior to 3.2.11, update to version 3.2.11 or later. As a temporary workaround, consider restricting the use of X.509 V1 certificates from trusted CAs to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-310

CWE-264

Related Identifiers

ALT-PU-2014-1263

BDU:2015-09761

CVE-2014-1959

DSA-2866-1

MGASA-2014-0077

OPENSUSE-SU-2024:10105-1

USN-2121-1

Affected Products

Alt Linux

Gnutls

References · 44

• 🔥 https://gitorious.org/gnutls/gnutls/commit/b1abfe3d182d68539900092eb42fc62cf1bb7e7c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-1959 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10105-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07249 · Security Note
• http://gnutls.org/security.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-1959 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01328 · Security Note
• https://ubuntu.com/security/CVE-2014-1959 · Vendor Advisory
• http://ubuntu.com/usn/USN-2121-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09730 · Security Note
• https://bdu.fstec.ru/vul/2015-07246 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-1959 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-1959 · Security Note
• https://bdu.fstec.ru/vul/2015-07253 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-1959 · Vendor Advisory