CVE-2015-0294 — gnutls: certificate algorithm consistency checking issue

Back Back to CVE browser

HIGH

gnutls: certificate algorithm consistency checking issue

Published Jan 27, 2020

7.5

HIGH

CVSS 3.1

EPSS 1.59%

Description

GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.

Affected products

Vendor GnuTLS Product GnuTLS Default
n/a
- Version
  before 3.3.13
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GnuTLS

n/a

Version	Status	Constraints
before 3.3.13	affected	-

Red Hat Enterprise Linux 6

gnutls-0:2.8.5-18.el6

Fixed · RHSA-2015:1457
Red Hat Enterprise Linux 5

gnutls

Will not fix
Red Hat Enterprise Linux 7

gnutls

Will not fix
Red Hat Enterprise Virtualization 3

mingw-virt-viewer

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	gnutls-0:2.8.5-18.el6	Fixed	RHSA-2015:1457
Red Hat Enterprise Linux 5	gnutls	Will not fix	n/a
Red Hat Enterprise Linux 7	gnutls	Will not fix	n/a
Red Hat Enterprise Virtualization 3	mingw-virt-viewer	Will not fix	n/a

Remediation

Red Hat statement

This issue affects the version of gnutls package as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. This issue affects the version of gnutls package as shipped with Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Extended Life Cycle phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Metrics

1.59% 0.01586

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01586

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (13 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.59% (0.01586)	74.70th	v5 (v2026.06.15)
Jun 15, 2026	1.59% (0.01586)	72.33th	v5 (v2026.06.15)
Mar 17, 2025	0.43% (0.00426)	60.20th	v4 (v2025.03.14)
Dec 12, 2024	0.41% (0.00406)	74.58th	v3 (v2023.03.01)
May 22, 2024	0.41% (0.00406)	73.72th	v3 (v2023.03.01)
Feb 8, 2024	0.57% (0.00575)	77.30th	v3 (v2023.03.01)
Jul 8, 2023	0.57% (0.00575)	75.00th	v3 (v2023.03.01)
May 8, 2023	0.70% (0.00697)	77.31th	v3 (v2023.03.01)
Mar 7, 2023	0.42% (0.00417)	70.08th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00954)	36.37th	v2 (v2022.01.01)
Sep 2, 2022	0.95% (0.00954)	34.50th	v2 (v2022.01.01)
Apr 1, 2022	0.95% (0.00954)	32.50th	v2 (v2022.01.01)
Feb 4, 2022	0.95% (0.00954)	16.28th	v2 (v2022.01.01)

Weaknesses (1)

CWE-295

Improper Certificate Validation

References (6)

http://www.debian.org/security/2015/dsa-3191
x_refsource_MISCThird Party Advisory
https://access.redhat.com/security/cve/CVE-2015-0294
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1196323
x_refsource_MISCIssue TrackingPatchThird Party Advisory
https://gitlab.com/gnutls/gnutls/commit/6e76e9b9fa845b76b0b9a45f05f4b54a052578ff
x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-0294
https://www.cve.org/CVERecord?id=CVE-2015-0294

Link	Providers	Tags
http://www.debian.org/security/2015/dsa-3191		x_refsource_MISCThird Party Advisory
https://access.redhat.com/security/cve/CVE-2015-0294		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1196323		x_refsource_MISCIssue TrackingPatchThird Party Advisory
https://gitlab.com/gnutls/gnutls/commit/6e76e9b9fa845b76b0b9a45f05f4b54a052578ff		x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-0294
https://www.cve.org/CVERecord?id=CVE-2015-0294