[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244625

 
 

909

 
 

193379

 
 

277

Paid content will be excluded from the download.


Download | Alert*
OVAL

DSA-1719-1 gnutls13 -- design flaw

ID: oval:org.secpod.oval:def:600469Date: (C)2011-05-13   (M)2024-02-15
Class: PATCHFamily: unix




Martin von Gagern discovered that GNUTLS, an implementation of the TLS/SSL protocol, handles verification of X.509 certificate chains incorrectly if a self-signed certificate is configured as a trusted certificate. This could cause clients to accept forged server certificates as genuine. In addition, this update tightens the checks for X.509v1 certificates which causes GNUTLS to reject certain certificate chains it accepted before. For the stable distribution , this problem has been fixed in version 1.4.4-3+etch3. For the unstable distribution , this problem has been fixed in version 2.4.2-3 of the gnutls26 package. We recommend that you upgrade your gnutls13 packages.

Platform:
Debian 4.0
Product:
gnutls13
Reference:
DSA-1719-1
CVE-2008-4989
CVE    1
CVE-2008-4989
CPE    1
cpe:/o:debian:debian_linux:4.0

© SecPod Technologies