CVE-2009-5138 — Improper Certificate Validation in Gnutls

CWE-264CWE-295 — Improper Certificate Validation7 documents6 sources
Severity
5.8MEDIUMNVD
EPSS
0.8%
top 25.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
GNU Gnutls
Timeline
PublishedMar 7
Latest updateMay 2

Description

GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates, a different vulnerability than CVE-2014-1959.

CVSS vector

AV:N/AC:M/C:P/I:P/A:NExploitability: 8.6 | Impact: 4.9

Affected Packages1 packages

▶NVDgnu/gnutls2.7.5+5

Patches

Patch: gitorious.org ↗Patch: gitorious.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-754r-c6vv-mv5g: GnuTLS before 2↗2022-05-02
▶
CVEList
CVE-2009-5138: GnuTLS before 2↗2014-03-06
▶

📋Vendor Advisories

2
Red Hat
gnutls: incorrect handling of V1 intermediate certificates↗2009-01-09
▶
Debian
CVE-2009-5138: gnutls28 - GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not ena...↗2009
▶

💬Community

2
Bugzilla
CVE-2009-5138 mingw32-gnutls: gnutls: incorrect handling of V1 intermediate certificates [epel-5]↗2014-03-03
▶
Bugzilla
CVE-2009-5138 gnutls: incorrect handling of V1 intermediate certificates↗2014-02-24
▶
CVE-2009-5138 — Improper Certificate Validation | cvebase