Bug#528281: gnutls26: CVE-2009-1417 certificate expiration vulnerability

Michael S. Gilbert michael.s.gilbert at gmail.com
Mon May 11 21:08:38 UTC 2009


Package: gnutls26
Severity: grave
Tags: security

Hi,

The following CVE (Common Vulnerabilities & Exposures) ids were
published for gnutls26.

CVE-2009-1417[0]:
| gnutls-cli in GnuTLS before 2.6.6 does not verify the activation and
| expiration times of X.509 certificates, which allows remote attackers
| to successfully present a certificate that is (1) not yet valid or (2)
| no longer valid, related to lack of time checks in the
| _gnutls_x509_verify_certificate function in lib/x509/verify.c in
| libgnutls_x509, as used by (a) Exim, (b) OpenLDAP, and (c) libsoup.

Note that this is fixed in 2.6.6-1 in unstable.  Please coordinate
with the security team (team at security.debian.org) to prepare updates
for the stable releases.

If you fix the vulnerabilities please also make sure to include the
CVE ids in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1417
    http://security-tracker.debian.net/tracker/CVE-2009-1417





More information about the Pkg-gnutls-maint mailing list