The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade gnutls | Aug 30, 2017 | Sep 27, 2016 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 27, 2016 |
| Centos_linux | — | Upgrade gnutls-daneUpgrade gnutls-c++Upgrade gnutls-utilsUpgrade gnutls-debuginfoUpgrade gnutls-develUpgrade gnutls | Aug 28, 2019 | Sep 27, 2016 |
| Debian | — | Upgrade gnutls28 | Jul 30, 2024 | Sep 27, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade gnutls-develUpgrade gnutlsUpgrade gnutls-utilsUpgrade gnutls-daneUpgrade gnutls-c++ | Nov 30, 2017 | Sep 27, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade gnutls-c++Upgrade gnutls-daneUpgrade gnutls-utilsUpgrade gnutlsUpgrade gnutls-devel | Nov 30, 2017 | Sep 27, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade gnutls-daneUpgrade gnutls-develUpgrade gnutls-utilsUpgrade gnutlsUpgrade gnutls-c++ | Oct 28, 2022 | Sep 27, 2016 |
| Oracle Solaris | — | Upgrade library/gnutls-3 to version 3.5.13-0.175.3.23.0.4.0 on Solaris 11.3 | Aug 21, 2017 | Sep 27, 2016 |
| Oracle_linux | — | Upgrade gnutls-c++Upgrade gnutlsUpgrade gnutls-daneUpgrade gnutls-develUpgrade gnutls-utils | Aug 8, 2017 | Sep 2, 2016 |
| Redhat_linux | — | Upgrade gnutlsUpgrade gnutls-c++Upgrade gnutls-utilsUpgrade gnutls-develUpgrade gnutls-debuginfoUpgrade gnutls-dane | Aug 4, 2017 | Sep 27, 2016 |
| Suse | — | Upgrade libgnutls28-32bitUpgrade libgnutls28Upgrade libgnutls-develUpgrade libgnutlsxx-develUpgrade gnutlsUpgrade libgnutls-openssl27Upgrade libgnutls-openssl-develUpgrade libgnutlsxx28 | Feb 2, 2017 | Sep 27, 2016 |
| Ubuntu | — | Upgrade libgnutls26Upgrade libgnutls30 | Feb 2, 2017 | Sep 27, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub