The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade gnutls | Aug 30, 2017 | Sep 27, 2016 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 27, 2016 |
| Centos_linux | — | Upgrade gnutls-develUpgrade gnutlsUpgrade gnutls-c++Upgrade gnutls-utilsUpgrade gnutls-daneUpgrade gnutls-debuginfo | Aug 28, 2019 | Sep 27, 2016 |
| Debian | — | Upgrade gnutls28 | Jul 30, 2024 | Sep 27, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade gnutls-develUpgrade gnutlsUpgrade gnutls-daneUpgrade gnutls-utilsUpgrade gnutls-c++ | Nov 30, 2017 | Sep 27, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade gnutls-daneUpgrade gnutls-c++Upgrade gnutlsUpgrade gnutls-utilsUpgrade gnutls-devel | Nov 30, 2017 | Sep 27, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade gnutls-daneUpgrade gnutls-develUpgrade gnutls-c++Upgrade gnutls-utilsUpgrade gnutls | Oct 28, 2022 | Sep 27, 2016 |
| Oracle Solaris | — | Upgrade library/gnutls-3 to version 3.5.13-0.175.3.23.0.4.0 on Solaris 11.3 | Aug 21, 2017 | Sep 27, 2016 |
| Oracle_linux | — | Upgrade gnutls-c++Upgrade gnutlsUpgrade gnutls-daneUpgrade gnutls-utilsUpgrade gnutls-devel | Aug 8, 2017 | Sep 2, 2016 |
| Redhat_linux | — | Upgrade gnutlsUpgrade gnutls-utilsUpgrade gnutls-c++Upgrade gnutls-develUpgrade gnutls-debuginfoUpgrade gnutls-dane | Aug 4, 2017 | Sep 27, 2016 |
| Suse | — | Upgrade libgnutlsxx-develUpgrade libgnutls28Upgrade libgnutls-develUpgrade libgnutls28-32bitUpgrade libgnutlsxx28Upgrade gnutlsUpgrade libgnutls-openssl27Upgrade libgnutls-openssl-devel | Feb 2, 2017 | Sep 27, 2016 |
| Ubuntu | — | Upgrade libgnutls26Upgrade libgnutls30 | Feb 2, 2017 | Sep 27, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub