CVE-2009-5138
published 2014-03-07CVE-2009-5138: GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows…
PriorityP429medium5.8CVSS 2.0
AVNACMAuNCPIPAN
EPSS
1.81%
76.4th percentile
GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates, a different vulnerability than CVE-2014-1959.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gnutls28 | — | — |
| gnu | gnutls | <= 2.7.5 | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
CVSS provenance
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
vendor_debian5.8LOW
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-754r-c6vv-mv5g: GnuTLS before 2
ghsa_unreviewed·2022-05-02·CVSS 5.8
CVE-2009-5138 [MEDIUM] GHSA-754r-c6vv-mv5g: GnuTLS before 2
GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates, a different vulnerability than CVE-2014-1959.
Red Hat
gnutls: incorrect handling of V1 intermediate certificates
vendor_redhat·2009-01-09·CVSS 5.8
CVE-2009-5138 [MEDIUM] CWE-295 gnutls: incorrect handling of V1 intermediate certificates
gnutls: incorrect handling of V1 intermediate certificates
GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates, a different vulnerability than CVE-2014-1959.
Statement: This issue did not affect the versions of gnutls as shipped with Red Hat Enterprise Linux 6.
Package: gnutls (Red Hat Enterprise Linux 6) - Not affected
Package: mingw32-gnutls (Red Hat Enterprise Linux 6) - Will not fix
Package: gnutls (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2009-5138: gnutls28 - GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not ena...
vendor_debian·2009·CVSS 5.8
CVE-2009-5138 [MEDIUM] CVE-2009-5138: gnutls28 - GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not ena...
GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates, a different vulnerability than CVE-2014-1959.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2009-5138 mingw32-gnutls: gnutls: incorrect handling of V1 intermediate certificates [epel-5]
bugzilla·2014-03-03·CVSS 5.8
CVE-2009-5138 [MEDIUM] CVE-2009-5138 mingw32-gnutls: gnutls: incorrect handling of V1 intermediate certificates [epel-5]
CVE-2009-5138 mingw32-gnutls: gnutls: incorrect handling of V1 intermediate certificates [epel-5]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
ep
Bugzilla
CVE-2009-5138 gnutls: incorrect handling of V1 intermediate certificates
bugzilla·2014-02-24·CVSS 5.8
CVE-2009-5138 [MEDIUM] CVE-2009-5138 gnutls: incorrect handling of V1 intermediate certificates
CVE-2009-5138 gnutls: incorrect handling of V1 intermediate certificates
While investigating GnuTLS issue CVE-2014-1959 (bug 1065092), it was discovered that older versions of GnuTLS were affected by the same problem, with a different root cause. When using default certificate verification settings, GnuTLS accepted version 1 X.509 certificates as intermediate CAs. An attacker able to obtain a V1 certificate from a CA trusted by application could generate certificates for other hosts or users that would be accepted by GnuTLS.
This issue affected GnuTLS versions before 2.7.6. Problem was reported in the following post:
http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351/focus=3361
and fixed upstream via:
https://gitorious.org/gnutls/gnutls/commit/c8dcbedd1fdc312f5b1a70fc
Bugzilla
CVE-2014-1959 gnutls: incorrect handling of V1 intermediate certificates (GNUTLS-SA-2014-1)
bugzilla·2014-02-13·CVSS 5.8
CVE-2014-1959 [MEDIUM] CVE-2014-1959 gnutls: incorrect handling of V1 intermediate certificates (GNUTLS-SA-2014-1)
CVE-2014-1959 gnutls: incorrect handling of V1 intermediate certificates (GNUTLS-SA-2014-1)
It was reported [1] that a version 1 intermediate certificate would be considered as a CA certificate by GnuTLS by default. This certificate verification behaviour deviates from the documented behaviour.
Upstream notes that this only affects individuals or organizations who have a CA that issues X.509 version 1 certificates in their trusted list.
This has been fixed upstream [2] in version 3.1.21 and 3.2.11.
At a quick look at the code of GnuTLS 2.8.5, it is affected. 1.4.1 looks affected to me as well.
[1] http://www.gnutls.org/security.html
[2] https://www.gitorious.org/gnutls/gnutls/commit/b1abfe3d18
Discussion:
Created mingw-gnutls tracking bugs for this issue:
Affects: fedora-all [bug
Bugzilla
CVE-2014-1959 mingw32-gnutls: gnutls: certificate verification flaw (GNUTLS-SA-2014-1) [epel-5]
bugzilla·2014-02-13·CVSS 5.8
CVE-2014-1959 [MEDIUM] CVE-2014-1959 mingw32-gnutls: gnutls: certificate verification flaw (GNUTLS-SA-2014-1) [epel-5]
CVE-2014-1959 mingw32-gnutls: gnutls: certificate verification flaw (GNUTLS-SA-2014-1) [epel-5]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
epel
http://article.gmane.org/gmane.comp.security.oss.general/12223http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-03/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-03/msg00020.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0247.htmlhttp://secunia.com/advisories/57254http://secunia.com/advisories/57260http://secunia.com/advisories/57274http://secunia.com/advisories/57321http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351/focus=3361http://thread.gmane.org/gmane.comp.security.oss.general/12127https://bugzilla.redhat.com/show_bug.cgi?id=1069301https://gitorious.org/gnutls/gnutls/commit/c8dcbedd1fdc312f5b1a70fcfbc1afe235d800cdhttp://article.gmane.org/gmane.comp.security.oss.general/12223http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-03/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-03/msg00020.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0247.htmlhttp://secunia.com/advisories/57254http://secunia.com/advisories/57260http://secunia.com/advisories/57274http://secunia.com/advisories/57321http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351/focus=3361http://thread.gmane.org/gmane.comp.security.oss.general/12127https://bugzilla.redhat.com/show_bug.cgi?id=1069301https://gitorious.org/gnutls/gnutls/commit/c8dcbedd1fdc312f5b1a70fcfbc1afe235d800cd
2014-03-07
Published