mod-gnutls - Security Update: Client Verify Mode Bypass
Summary
DSA-3177-1: mod-gnutls - security update. Affects mod-gnutls versions < 0.5.10-1.1+deb7u1. Fixed in 0.5.10-1.1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mod-gnutls is an Apache module that provides SSL and TLS encryption using the GnuTLS library. It allows Apache servers to secure communications with clients using the HTTPS protocol. This module is commonly used to enable secure connections on web servers. However, a vulnerability has been discovered in mod-gnutls that could allow clients with invalid certificates to bypass the server's client verify mode and gain unauthorized access to certain directories.
Vulnerability Detail
The vulnerability in mod-gnutls arises from a bug that causes the server's client verify mode to be ignored when the directory's configuration is unset. This means that clients with invalid certificates can exploit this flaw to gain access to directories that should be restricted. The impact of this vulnerability is that unauthorized users may be able to view or modify sensitive data in these directories, depending on the permissions set for those directories.
How To Fix
Minimum fixed version
0.5.10-1.1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mod-gnutlsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to always configure the server's client verify mode explicitly and ensure that the directory's configuration is properly set. This will help mitigate the risk of clients with invalid certificates bypassing the verification process.
Conclusion
In conclusion, the mod-gnutls module in Apache is vulnerable to a bypass of the server's client verify mode, allowing clients with invalid certificates to gain unauthorized access to certain directories. To mitigate this vulnerability, it is crucial to upgrade to the recommended versions of the mod-gnutls package and ensure proper configuration of the server's client verify mode. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mod-gnutls →
FAQ
mod-gnutls is an Apache module that provides SSL and TLS encryption using the GnuTLS library. It allows Apache servers to secure communications with clients using the HTTPS protocol.
The impact of this vulnerability is that clients with invalid certificates can bypass the server's client verify mode and gain unauthorized access to certain directories. This may allow them to view or modify sensitive data in those directories.
To fix this vulnerability, you should upgrade the mod-gnutls package to the recommended versions. For the stable distribution (wheezy), upgrade to version 0.5.10-1.1+deb7u1. For the unstable distribution (sid), upgrade to version 0.6-1.3.
While no specific workaround is mentioned, it is recommended to configure the server's client verify mode explicitly and ensure that the directory's configuration is properly set. This can help mitigate the risk of clients with invalid certificates bypassing the verification process.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in software.
Related vulnerabilities
Recent vulnerabilities recorded for mod-gnutls.
