lib/x509/verify.c in GnuTLS before 3.1.21 and 3.2.x before 3.2.11 treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade gnutls | Aug 30, 2017 | Mar 6, 2014 |
| Debian | — | Upgrade gnutls26Upgrade gnutls28 | Jul 30, 2024 | Mar 7, 2014 |
| Freebsd | — | Upgrade linux-f10-gnutlsUpgrade gnutls3Upgrade gnutlsUpgrade gnutls-devel | Dec 10, 2025 | Mar 4, 2014 |
| Gentoo Linux | — | Upgrade net-libs/gnutls. | Oct 30, 2017 | Mar 6, 2014 |
| Suse | — | Upgrade libgnutls30Upgrade libgnutls-openssl-develUpgrade libgnutls-openssl27Upgrade libgnutlsxx28Upgrade gnutlsUpgrade libgnutls30-32bitUpgrade libgnutls-dane0Upgrade libgnutls-develUpgrade libgnutlsxx-develUpgrade libgnutls28Upgrade libgnutls28-32bit | Dec 9, 2016 | Mar 6, 2014 |
| Ubuntu | — | Upgrade libgnutls26 | Nov 8, 2024 | Mar 7, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub