Red Hat Security AdvisoryRHSA-2014:0247
gnutls security update
Released 2014-03-03 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) gnutls-1.4.1-14.el5_10, gnutls-1.4.1-14.el5_10.i386, gnutls-1.4.1-14.el5_10.ia64 +9
- Red Hat Enterprise Linux Desktop (v. 5 client) gnutls-1.4.1-14.el5_10, gnutls-1.4.1-14.el5_10.i386, gnutls-utils-1.4.1-14.el5_10 +1
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) gnutls-1.4.1-14.el5_10, gnutls-devel-1.4.1-14.el5_10, gnutls-devel-1.4.1-14.el5_10.i386
Fixes 2 records
Priority MEDIUM 49
lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers…
CVSS 2.0MEDIUM 5.8· Network · No auth · Interaction — · EPSS 0.2986 · Published 2014-03-06 · Partial fix CWE-310
Priority LOW 30
GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a…
CVSS 2.0MEDIUM 5.8· Network · No auth · Interaction — · EPSS 0.01799 · Published 2014-03-06 · Partial fix CWE-264
