|Number of vulnerabilities||1|
|CVE ID|| CVE-2016-7444
|CWE ID|| CWE-20
|Public exploit||Not available|
|Vulnerable software versions||
The vulnerability allows a remote unauthenticated attacker to bypass security restrictions on the target system.
The weakness exists due to insufficient validation of the serial length of an OCSP response by the gnutls_ocsp_resp_check_crt function in the lib/x509/ocsp.c code. A remote attacker can bypass certificate validation and conduct further attacks.
Update to version 3.4.15 or 3.5.4.External links