CVE-2014-0092

gnutls: incorrect error handling in certificate verification (GNUTLS-SA-2014-2)

Severity Score

5.8

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

lib/x509/verify.c en GnuTLS anterior a 3.1.22 y 3.2.x anterior a 3.2.12 no maneja debidamente errores no especificados cuando verifica certificados X.509 de servidores SSL, lo que permite a atacantes man-in-the-middle falsificar servidores a través de un certificado manipulado.

*Credits: N/A

CVSS Scores

NISTv2 5.8

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2013-12-03 CVE Reserved
2014-03-03 CVE Published
2024-08-06 CVE Updated
2024-09-21 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-295: Improper Certificate Validation
CWE-310: Cryptographic Issues

CAPEC

References (27)

URL	Tag	Source
http://gnutls.org/security.html#GNUTLS-SA-2014-2	X_refsource_confirm
http://secunia.com/advisories/57103	Third Party Advisory
http://secunia.com/advisories/57254	Third Party Advisory
http://secunia.com/advisories/57260	Third Party Advisory
http://secunia.com/advisories/57274	Third Party Advisory
http://secunia.com/advisories/57321	Third Party Advisory
http://www.securityfocus.com/bid/65919	Vdb Entry

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00000.html	2016-11-28
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html	2016-11-28
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00002.html	2016-11-28
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00003.html	2016-11-28
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00004.html	2016-11-28
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00005.html	2016-11-28
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00006.html	2016-11-28
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00007.html	2016-11-28
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00009.html	2016-11-28
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00020.html	2016-11-28
http://rhn.redhat.com/errata/RHSA-2014-0246.html	2016-11-28
http://rhn.redhat.com/errata/RHSA-2014-0247.html	2016-11-28
http://rhn.redhat.com/errata/RHSA-2014-0288.html	2016-11-28
http://rhn.redhat.com/errata/RHSA-2014-0339.html	2016-11-28
http://secunia.com/advisories/56933	2016-11-28
http://secunia.com/advisories/57204	2016-11-28
http://www.debian.org/security/2014/dsa-2869	2016-11-28
http://www.ubuntu.com/usn/USN-2127-1	2016-11-28
https://bugzilla.redhat.com/show_bug.cgi?id=1069865	2014-03-31
https://access.redhat.com/security/cve/CVE-2014-0092	2014-03-31

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				<= 3.2.11 Search vendor "Gnu" for product "Gnutls" and version " <= 3.2.11"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.2.0 Search vendor "Gnu" for product "Gnutls" and version "3.2.0"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.2.1 Search vendor "Gnu" for product "Gnutls" and version "3.2.1"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.2.2 Search vendor "Gnu" for product "Gnutls" and version "3.2.2"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.2.3 Search vendor "Gnu" for product "Gnutls" and version "3.2.3"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.2.4 Search vendor "Gnu" for product "Gnutls" and version "3.2.4"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.2.5 Search vendor "Gnu" for product "Gnutls" and version "3.2.5"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.2.6 Search vendor "Gnu" for product "Gnutls" and version "3.2.6"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.2.7 Search vendor "Gnu" for product "Gnutls" and version "3.2.7"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.2.8 Search vendor "Gnu" for product "Gnutls" and version "3.2.8"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.2.8.1 Search vendor "Gnu" for product "Gnutls" and version "3.2.8.1"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.2.9 Search vendor "Gnu" for product "Gnutls" and version "3.2.9"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.2.10 Search vendor "Gnu" for product "Gnutls" and version "3.2.10"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				<= 3.1.21 Search vendor "Gnu" for product "Gnutls" and version " <= 3.1.21"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.0 Search vendor "Gnu" for product "Gnutls" and version "3.1.0"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.1 Search vendor "Gnu" for product "Gnutls" and version "3.1.1"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.2 Search vendor "Gnu" for product "Gnutls" and version "3.1.2"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.3 Search vendor "Gnu" for product "Gnutls" and version "3.1.3"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.4 Search vendor "Gnu" for product "Gnutls" and version "3.1.4"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.5 Search vendor "Gnu" for product "Gnutls" and version "3.1.5"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.6 Search vendor "Gnu" for product "Gnutls" and version "3.1.6"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.7 Search vendor "Gnu" for product "Gnutls" and version "3.1.7"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.8 Search vendor "Gnu" for product "Gnutls" and version "3.1.8"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.9 Search vendor "Gnu" for product "Gnutls" and version "3.1.9"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.10 Search vendor "Gnu" for product "Gnutls" and version "3.1.10"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.11 Search vendor "Gnu" for product "Gnutls" and version "3.1.11"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.12 Search vendor "Gnu" for product "Gnutls" and version "3.1.12"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.13 Search vendor "Gnu" for product "Gnutls" and version "3.1.13"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.14 Search vendor "Gnu" for product "Gnutls" and version "3.1.14"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.15 Search vendor "Gnu" for product "Gnutls" and version "3.1.15"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.16 Search vendor "Gnu" for product "Gnutls" and version "3.1.16"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.17 Search vendor "Gnu" for product "Gnutls" and version "3.1.17"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.18 Search vendor "Gnu" for product "Gnutls" and version "3.1.18"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.19 Search vendor "Gnu" for product "Gnutls" and version "3.1.19"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.20 Search vendor "Gnu" for product "Gnutls" and version "3.1.20"		-		Affected