gnutls: certificate expiration not checked by gnutls-cli [GNUTLS-SA-2009-3]
Published Apr 30, 2009
5.0
MEDIUMCVSS 2.0
EPSS 1.43%
Description
gnutls-cli in GnuTLS before 2.6.6 does not verify the activation and expiration times of X.509 certificates, which allows remote attackers to successfully present a certificate that is (1) not yet valid or (2) no longer valid, related to lack of time checks in the _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls_x509, as used by (a) Exim, (b) OpenLDAP, and (c) libsoup.
Affected products
No data.
- ≤ 2.6.5
- 1.0.16
- 1.0.17
- 1.0.18
- 1.0.19
- 1.0.20
- 1.0.21
- 1.0.22
- 1.0.23
- 1.0.24
- 1.0.25
- 1.1.13
- 1.1.14
- 1.1.15
- 1.1.16
- 1.1.17
- 1.1.18
- 1.1.19
- 1.1.20
- 1.1.21
- 1.1.22
- 1.1.23
- 1.2.0
- 1.2.1
- 1.2.2
- 1.2.3
- 1.2.4
- 1.2.5
- 1.2.6
- 1.2.7
- 1.2.8
- 1.2.8.1a1
- 1.2.9
- 1.2.10
- 1.2.11
- 1.3.0
- 1.3.1
- 1.3.2
- 1.3.3
- 1.3.4
- 1.3.5
- 1.4.0
- 1.4.1
- 1.4.2
- 1.4.3
- 1.4.4
- 1.4.5
- 1.5.0
- 1.5.1
- 1.5.2
- 1.5.3
- 1.5.4
- 1.5.5
- 1.6.0
- 1.6.1
- 1.6.2
- 1.6.3
- 1.7.0
- 1.7.1
- 1.7.2
- 1.7.3
- 1.7.4
- 1.7.5
- 1.7.6
- 1.7.7
- 1.7.8
- 1.7.9
- 1.7.10
- 1.7.11
- 1.7.12
- 1.7.13
- 1.7.14
- 1.7.15
- 1.7.16
- 1.7.17
- 1.7.18
- 1.7.19
- 2.0.0
- 2.0.1
- 2.0.2
- 2.0.3
- 2.0.4
- 2.1.0
- 2.1.1
- 2.1.2
- 2.1.3
- 2.1.4
- 2.1.5
- 2.1.6
- 2.1.7
- 2.1.8
- 2.2.0
- 2.2.1
- 2.2.2
- 2.2.3
- 2.2.4
- 2.2.5
- 2.3.0
- 2.3.1
- 2.3.2
- 2.3.3
- 2.3.4
- 2.3.5
- 2.3.6
- 2.3.7
- 2.3.8
- 2.3.9
- 2.3.10
- 2.3.11
- 2.4.0
- 2.4.1
- 2.4.2
- 2.6.0
- 2.6.1
- 2.6.2
- 2.6.3
- 2.6.4
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Red Hat statement
The Red Hat Product Security has rated this issue as having low security impact. The risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 4, or 5. For further details, see: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-1417
References (13)
- http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3517 mailing-listx_refsource_MLISTPatch
- http://secunia.com/advisories/34842 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/35211 third-party-advisoryx_refsource_SECUNIA
- http://security.gentoo.org/glsa/glsa-200905-04.xml vendor-advisoryx_refsource_GENTOO
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:116 vendor-advisoryx_refsource_MANDRIVA
- http://www.securityfocus.com/bid/34783 vdb-entryx_refsource_BID
- http://www.securitytracker.com/id?1022159 vdb-entryx_refsource_SECTRACK
- http://www.vupen.com/english/advisories/2009/1218 vdb-entryx_refsource_VUPEN
- https://access.redhat.com/security/cve/CVE-2009-1417 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=497983 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50261 vdb-entryx_refsource_XF
- https://nvd.nist.gov/vuln/detail/CVE-2009-1417
- https://www.cve.org/CVERecord?id=CVE-2009-1417
| Link | Providers | Tags |
|---|---|---|
| http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3517 | mailing-listx_refsource_MLISTPatch | |
| http://secunia.com/advisories/34842 | third-party-advisoryx_refsource_SECUNIAVendor Advisory | |
| http://secunia.com/advisories/35211 | third-party-advisoryx_refsource_SECUNIA | |
| http://security.gentoo.org/glsa/glsa-200905-04.xml | vendor-advisoryx_refsource_GENTOO | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2009:116 | vendor-advisoryx_refsource_MANDRIVA | |
| http://www.securityfocus.com/bid/34783 | vdb-entryx_refsource_BID | |
| http://www.securitytracker.com/id?1022159 | vdb-entryx_refsource_SECTRACK | |
| http://www.vupen.com/english/advisories/2009/1218 | vdb-entryx_refsource_VUPEN | |
| https://access.redhat.com/security/cve/CVE-2009-1417 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=497983 | Issue Tracking | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/50261 | vdb-entryx_refsource_XF | |
| https://nvd.nist.gov/vuln/detail/CVE-2009-1417 | ||
| https://www.cve.org/CVERecord?id=CVE-2009-1417 |
Change history (0)
No recorded changes yet.