Cryptographic issues in GnuTLS - CVE-2014-0092
Published: March 7, 2014 / Updated: July 28, 2020
Vulnerability identifier: #VU32575
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-0092
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
Affected software
GnuTLS
Amazon Linux AMI
Gentoo Linux
SUSE Linux
Slackware Linux
gnutls (Alpine package)
TS3000
Amazon Linux AMI
Gentoo Linux
SUSE Linux
Slackware Linux
gnutls (Alpine package)
TS3000
How to mitigate CVE-2014-0092
Install update from vendor's website.
GnuTLS - update to 3.1.22
gnutls (Alpine package) - update to 3.0.29-r1
TS3000 - update to 7.3.15
gnutls (Alpine package) - update to 3.0.29-r1
TS3000 - update to 7.3.15
External References
- http://gnutls.org/security.html#GNUTLS-SA-2014-2
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00020.html
- http://rhn.redhat.com/errata/RHSA-2014-0246.html
- http://rhn.redhat.com/errata/RHSA-2014-0247.html
- http://rhn.redhat.com/errata/RHSA-2014-0288.html
- http://rhn.redhat.com/errata/RHSA-2014-0339.html
- http://secunia.com/advisories/56933
- http://secunia.com/advisories/57103
- http://secunia.com/advisories/57204
- http://secunia.com/advisories/57254
- http://secunia.com/advisories/57260
- http://secunia.com/advisories/57274
- http://secunia.com/advisories/57321
- http://www.debian.org/security/2014/dsa-2869
- http://www.securityfocus.com/bid/65919
- http://www.ubuntu.com/usn/USN-2127-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1069865
Related Security Bulletins
- Cryptographic issues in GnuTLS
- Cryptographic issues in gnutls (Alpine package)
- SUSE Linux update for gnutls
- SUSE Linux update for gnutls
- SUSE Linux update for gnutls
- SUSE Linux update for gnutls
- Amazon Linux AMI update for gnutls
- Gentoo update for GnuTLS
- Slackware Linux update for gnutls
- Cryptographic issues in IBM TS3000