Certificate Verification Flaw in gnutls26
Summary
DSA-2866-1: gnutls26 - certificate verification flaw. Affects gnutls26 versions < 2.12.20-8. Fixed in 2.12.20-8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gnutls26 is a library implementing the SSL, TLS, and DTLS protocols. It provides a secure communication channel over the internet and is widely used in various applications. However, a vulnerability has been discovered in gnutls26 that affects its certificate verification process.
Vulnerability Detail
The vulnerability in gnutls26 arises from a deviation in its behavior related to certificate verification. By default, gnutls26 considers a version 1 intermediate certificate as a CA (Certificate Authority) certificate, contrary to the documented behavior. This can lead to the acceptance of potentially untrusted certificates, compromising the security of the communication channel.
How To Fix
Minimum fixed version
2.12.20-8
This is the first release that contains the fix.
sudo apt-get install --only-upgrade gnutls26Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the gnutls26 library is vulnerable to a certificate verification flaw that can compromise the security of the communication channel. It is recommended to upgrade to the fixed version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gnutls26 →
FAQ
gnutls26 is a library that implements SSL, TLS, and DTLS protocols for secure communication over the internet.
This vulnerability can lead to the acceptance of potentially untrusted certificates, compromising the security of the communication channel.
The stable distribution (wheezy) of gnutls26 prior to version 2.12.20-8 is affected.
No specific workarounds have been mentioned for this vulnerability.
To fix this vulnerability, upgrade the gnutls26 package to version 2.12.20-8 or later.
Related vulnerabilities
Recent vulnerabilities recorded for gnutls26.
