CVE-2009-5138

Published: Mar 7, 2014Modified: May 6, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates, a different vulnerability than CVE-2014-1959.

Affected (6)

Products: Gnu: Gnutls

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gnu Gnutls	Up to 2.7.5
Gnu Gnutls	Version 2.7.0
Gnu Gnutls	Version 2.7.1
Gnu Gnutls	Version 2.7.2
Gnu Gnutls	Version 2.7.3
Gnu Gnutls	Version 2.7.4

Related CWEs

References (28)

http://article.gmane.org/gmane.comp.security.oss.general/12223

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00000.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00003.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00020.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0247.html

Source: secalert@redhat.com

http://secunia.com/advisories/57254

Source: secalert@redhat.com

http://secunia.com/advisories/57260

Source: secalert@redhat.com

http://secunia.com/advisories/57274

Source: secalert@redhat.com

http://secunia.com/advisories/57321

Source: secalert@redhat.com

http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351/focus=3361

Source: secalert@redhat.com

http://thread.gmane.org/gmane.comp.security.oss.general/12127

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1069301

Source: secalert@redhat.com

https://gitorious.org/gnutls/gnutls/commit/c8dcbedd1fdc312f5b1a70fcfbc1afe235d800cd

Source: secalert@redhat.com

ExploitPatch

http://article.gmane.org/gmane.comp.security.oss.general/12223

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00020.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2014-0247.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/57254

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/57260

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/57274

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/57321

Source: af854a3a-2127-422b-91ae-364da2661108

http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351/focus=3361

Source: af854a3a-2127-422b-91ae-364da2661108

http://thread.gmane.org/gmane.comp.security.oss.general/12127

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=1069301

Source: af854a3a-2127-422b-91ae-364da2661108

https://gitorious.org/gnutls/gnutls/commit/c8dcbedd1fdc312f5b1a70fcfbc1afe235d800cd

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

Timeline

No history available yet.