PT-2015-5598 · Gnutls · Mod-Gnutls

Thomas Klute · Published 2015-03-10 · Updated 2017-09-19 · CVE-2015-2091

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions mod-gnutls versions 0.5.10 and earlier

Description The issue concerns the authentication hook in mod-gnutls, which fails to validate client certificates under certain conditions, allowing remote attackers to spoof clients by using a crafted certificate.

Recommendations For mod-gnutls versions 0.5.10 and earlier, consider updating to a version where this issue is fixed, as the current version does not properly validate client certificates when "GnuTLSClientVerify require" is set. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2015-2091

DLA-170-1

DSA-3177-1

Affected Products

Mod-Gnutls

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2015-2091 · Security Note
• https://osv.dev/vulnerability/DSA-3177-1 · Vendor Advisory
• http://debian.org/security/2015/dsa-3177 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/mod-gnutls · Vendor Advisory
• https://security.gentoo.org/glsa/201709-04 · Vendor Advisory
• http://issues.outoforder.cc/view.php?id=93 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3177-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2091 · Security Note
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=578663 · Note
• https://packages.debian.org/src:mod-gnutls · Note