CVE-2008-4989

Publication date 12 November 2008

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).

Status

Show unmaintained releases

Package	Ubuntu Release	Status
gnutls11	9.10 karmic	Not in release
	9.04 jaunty	Not in release
	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	7.10 gutsy	Not in release
	6.06 LTS dapper	Ignored
gnutls12	9.10 karmic	Not in release
	9.04 jaunty	Not in release
	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	7.10 gutsy	Not in release
	6.06 LTS dapper	Fixed 1.2.9-2ubuntu1.3
gnutls13	9.10 karmic	Not in release
	9.04 jaunty	Not in release
	8.10 intrepid	Not in release
	8.04 LTS hardy	Fixed 2.0.4-1ubuntu2.2
	7.10 gutsy	Fixed 1.6.3-1ubuntu0.2
	6.06 LTS dapper	Not in release
gnutls26	9.10 karmic	Not affected
	9.04 jaunty	Not affected
	8.10 intrepid	Fixed 2.4.1-1ubuntu0.1
	8.04 LTS hardy	Not in release
	7.10 gutsy	Not in release
	6.06 LTS dapper	Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
gnutls11	Vendor: https://rhn.redhat.com/errata/RHSA-2008-0982.html

Severity score breakdown

Parameter	Value
Base score	5.9 · Medium
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	High
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CVE-2008-4989

Cvss 3 Severity Score

Status

Patch details

Severity score breakdown

References

Related Ubuntu Security Notices (USN)

Other references