A vulnerability in mod_gnutls allows remote attackers to spoof clients via crafted certificates.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201709-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: mod_gnutls: Certificate validation error Date: September 17, 2017 Bugs: #541038 ID: 201709-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A vulnerability in mod_gnutls allows remote attackers to spoof clients via crafted certificates. Background ========= mod_gnutls is an extension for ​Apache's httpd. It uses the ​GnuTLS library to provide HTTPS. It supports some protocols and features that mod_ssl does not. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-apache/mod_gnutls < 0.7.3 > = 0.7.3 Description ========== It was discovered that the authentication hook in mod_gnutls does not validate client's certificates even when option "GnuTLSClientVerify" is set to "require". Impact ===== A remote attacker could present a crafted certificate and spoof clients data. Workaround ========= There is no known workaround at this time. Resolution ========= All mod_gnutls users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =www-apache/mod_gnutls-0.7.3" References ========= [ 1 ] CVE-2015-2091 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2091 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201709-04 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Moderate: gnutls security update. Date: Wed, 12 Nov 2008 12:26:34 -0600 Reply-To: Troy Dawson Sender: Security Errata for Scientific Linux From: Troy Dawson Subject: Security ERRATA for gnutls on SL5.x i386/x86_64 Comments: To: "
Get the latest Linux and open source security news straight to your inbox.