CVE-2014-0092

Published: Mar 7, 2014Modified: May 6, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

Affected (35)

Products: Gnu: Gnutls

1 product

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Gnu Gnutls	Up to 3.2.11
Gnu Gnutls	Version 3.2.0
Gnu Gnutls	Version 3.2.10
Gnu Gnutls	Version 3.2.1
Gnu Gnutls	Version 3.2.2
Gnu Gnutls	Version 3.2.3
Gnu Gnutls	Version 3.2.4
Gnu Gnutls	Version 3.2.5
Gnu Gnutls	Version 3.2.6
Gnu Gnutls	Version 3.2.7
Gnu Gnutls	Version 3.2.8.1
Gnu Gnutls	Version 3.2.8
Gnu Gnutls	Version 3.2.9

Configuration B

22 vulnerable

Vulnerable Software	Affected Versions
Gnu Gnutls	Up to 3.1.21
Gnu Gnutls	Version 3.1.0
Gnu Gnutls	Version 3.1.10
Gnu Gnutls	Version 3.1.11
Gnu Gnutls	Version 3.1.12
Gnu Gnutls	Version 3.1.13
Gnu Gnutls	Version 3.1.14
Gnu Gnutls	Version 3.1.15
Gnu Gnutls	Version 3.1.16
Gnu Gnutls	Version 3.1.17
Gnu Gnutls	Version 3.1.18
Gnu Gnutls	Version 3.1.19
Gnu Gnutls	Version 3.1.1
Gnu Gnutls	Version 3.1.20
Gnu Gnutls	Version 3.1.2
Gnu Gnutls	Version 3.1.3
Gnu Gnutls	Version 3.1.4
Gnu Gnutls	Version 3.1.5
Gnu Gnutls	Version 3.1.6
Gnu Gnutls	Version 3.1.7
Gnu Gnutls	Version 3.1.8
Gnu Gnutls	Version 3.1.9

Related CWEs

References (52)

http://gnutls.org/security.html#GNUTLS-SA-2014-2

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00000.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00002.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00003.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00004.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00005.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00006.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00007.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00009.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00020.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0246.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0247.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0288.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0339.html

Source: secalert@redhat.com

http://secunia.com/advisories/56933

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/57103

Source: secalert@redhat.com

http://secunia.com/advisories/57204

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/57254

Source: secalert@redhat.com

http://secunia.com/advisories/57260

Source: secalert@redhat.com

http://secunia.com/advisories/57274

Source: secalert@redhat.com

http://secunia.com/advisories/57321

Source: secalert@redhat.com

http://www.debian.org/security/2014/dsa-2869

Source: secalert@redhat.com

http://www.securityfocus.com/bid/65919

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2127-1

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1069865

Source: secalert@redhat.com

http://gnutls.org/security.html#GNUTLS-SA-2014-2

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00002.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00004.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00005.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00006.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00007.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00009.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00020.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2014-0246.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2014-0247.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2014-0288.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2014-0339.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/56933

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/57103

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/57204

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/57254

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/57260

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/57274

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/57321

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2014/dsa-2869

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/65919

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2127-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=1069865

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.