SB2015081905 - Ubuntu update for gnutls12, gnutls13, gnutls26
Published: August 19, 2015 Updated: October 30, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Cryptographic issues (CVE-ID: CVE-2009-2409)
CWE-ID: CWE-310 - Cryptographic Issues
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
2) Improper Certificate Validation (CVE-ID: CVE-2009-2730)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to spoof certificate hostname validation.
The vulnerability exists due to improper certificate validation in certificate hostname validation when verifying certificates. A remote attacker can present a certificate with a mismatched hostname to spoof certificate hostname validation.
Remediation
Install update from vendor's website.