gnutls-cli in GnuTLS before 2.6.6 does not verify the activation and expiration times of X.509 certificates, which allows remote attackers to successfully present a certificate that is (1) not yet valid or (2) no longer valid, related to lack of time checks in the _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls_x509, as used by (a) Exim, (b) OpenLDAP, and (c) libsoup.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 01:02
Type | Values Removed | Values Added |
---|---|---|
References | () http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3517 - Patch | |
References | () http://secunia.com/advisories/34842 - Vendor Advisory | |
References | () http://secunia.com/advisories/35211 - | |
References | () http://security.gentoo.org/glsa/glsa-200905-04.xml - | |
References | () http://www.mandriva.com/security/advisories?name=MDVSA-2009:116 - | |
References | () http://www.securityfocus.com/bid/34783 - | |
References | () http://www.securitytracker.com/id?1022159 - | |
References | () http://www.vupen.com/english/advisories/2009/1218 - | |
References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/50261 - |
Information
Published : 2009-04-30 20:30
Updated : 2024-11-21 01:02
NVD link : CVE-2009-1417
Mitre link : CVE-2009-1417
CVE.ORG link : CVE-2009-1417
JSON object : View
Products Affected
gnu
- gnutls
CWE
CWE-310
Cryptographic Issues