The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade gnutls | Aug 30, 2017 | Sep 27, 2016 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 27, 2016 |
| Centos_linux | — | Upgrade gnutls-develUpgrade gnutlsUpgrade gnutls-utilsUpgrade gnutls-daneUpgrade gnutls-c++Upgrade gnutls-debuginfo | Aug 28, 2019 | Sep 27, 2016 |
| Debian | — | Upgrade gnutls28 | Jul 30, 2024 | Sep 27, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade gnutls-daneUpgrade gnutls-develUpgrade gnutlsUpgrade gnutls-utilsUpgrade gnutls-c++ | Nov 30, 2017 | Sep 27, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade gnutls-utilsUpgrade gnutls-develUpgrade gnutlsUpgrade gnutls-c++Upgrade gnutls-dane | Nov 30, 2017 | Sep 27, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade gnutlsUpgrade gnutls-utilsUpgrade gnutls-c++Upgrade gnutls-develUpgrade gnutls-dane | Oct 28, 2022 | Sep 27, 2016 |
| Oracle Solaris | — | Upgrade library/gnutls-3 to version 3.5.13-0.175.3.23.0.4.0 on Solaris 11.3 | Aug 21, 2017 | Sep 27, 2016 |
| Oracle_linux | — | Upgrade gnutls-utilsUpgrade gnutls-develUpgrade gnutls-c++Upgrade gnutlsUpgrade gnutls-dane | Aug 8, 2017 | Sep 2, 2016 |
| Redhat_linux | — | Upgrade gnutls-daneUpgrade gnutls-develUpgrade gnutls-utilsUpgrade gnutlsUpgrade gnutls-c++Upgrade gnutls-debuginfo | Aug 4, 2017 | Sep 27, 2016 |
| Suse | — | Upgrade libgnutlsxx-develUpgrade libgnutls-develUpgrade libgnutls28Upgrade libgnutls28-32bitUpgrade libgnutlsxx28Upgrade libgnutls-openssl-develUpgrade libgnutls-openssl27Upgrade gnutls | Feb 2, 2017 | Sep 27, 2016 |
| Ubuntu | — | Upgrade libgnutls30Upgrade libgnutls26 | Feb 2, 2017 | Sep 27, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub