CVE-2015-0294
GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.
- Обновитесь до 2.12.23-12ubuntu2.2
Опубликовано Обновлено
PatchFirst · Свежие уязвимости
Уязвимости gnutls26
За последние 30 дней в gnutls26 опубликовано уязвимостей: 0; в каталоге KEV: 0.
Уязвимостей: 13
CVE-2015-8313
GnuTLS incorrectly validates the first byte of padding in CBC modes
- Обновитесь до 2.12.23-12ubuntu2.3
Опубликовано ОбновленоCVE-2016-8610
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.
- Обновитесь до 2.12.23-12ubuntu2.7
Опубликовано ОбновленоCVE-2017-7869
GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue (which is a subset of the vendor's GNUTLS-SA-2017-3 report) is fixed in 3.5.10.
- Обновитесь до 2.12.23-12ubuntu2.8
Опубликовано ОбновленоCVE-2017-5337
Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.
- Обновитесь до 2.12.23-12ubuntu2.6
Опубликовано ОбновленоCVE-2017-5336
Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.
- Обновитесь до 2.12.23-12ubuntu2.6
Опубликовано ОбновленоCVE-2017-5335
The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate.
- Обновитесь до 2.12.23-12ubuntu2.6
Опубликовано Обновленоgnutls26 update
USN-2913-1 removed 1024-bit RSA CA certificates from the ca-certificates package. This update adds support for alternate certificate chains to the GnuTLS package to properly handle the removal. Original advisory details: The ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the 20160104 package, including the removal of the SPI CA and CA certificates with 1024-bit RSA keys.
- Обновитесь до 2.12.23-12ubuntu2.5
Опубликовано ОбновленоCVE-2015-7575
Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.
- Обновитесь до 2.12.23-12ubuntu2.4
Опубликовано ОбновленоCVE-2015-0282
GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
- Обновитесь до 2.12.23-12ubuntu2.2
Опубликовано ОбновленоCVE-2014-3466
Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.
- Обновитесь до 2.12.23-12ubuntu2.1
Опубликовано ОбновленоCVE-2014-1959
lib/x509/verify.c in GnuTLS before 3.1.21 and 3.2.x before 3.2.11 treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates.
- Обновитесь до 2.12.23-12ubuntu1
Опубликовано ОбновленоCVE-2014-0092
lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
- Обновитесь до 2.12.23-12ubuntu2
Опубликовано Обновлено
Проверьте свой сервер
Сопоставьте установленный стек и версии со свежими базами уязвимостей.