Improper Certificate Validation in GnuTLS - CVE-2009-2730
Published: August 12, 2009 / Updated: April 30, 2026
Vulnerability identifier: #VU128566
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2009-2730
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to spoof certificate hostname validation.
The vulnerability exists due to improper certificate validation in certificate hostname validation when verifying certificates. A remote attacker can present a certificate with a mismatched hostname to spoof certificate hostname validation.
Affected software
GnuTLS
Ubuntu
libgnutls12 (Ubuntu package)
libgnutls13 (Ubuntu package)
libgnutls26 (Ubuntu package)
Ubuntu
libgnutls12 (Ubuntu package)
libgnutls13 (Ubuntu package)
libgnutls26 (Ubuntu package)
How to mitigate CVE-2009-2730
Install security update from vendor's website.
GnuTLS - update to 2.8.3
libgnutls12 (Ubuntu package) - update to 1.2.9-2ubuntu1.7
libgnutls13 (Ubuntu package) - update to 2.0.4-1ubuntu2.6
libgnutls26 (Ubuntu package) - addressed in versions 2.4.1-1ubuntu0.4, 2.4.2-6ubuntu0.1
libgnutls12 (Ubuntu package) - update to 1.2.9-2ubuntu1.7
libgnutls13 (Ubuntu package) - update to 2.0.4-1ubuntu2.6
libgnutls26 (Ubuntu package) - addressed in versions 2.4.1-1ubuntu0.4, 2.4.2-6ubuntu0.1