{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A4950F54-4C00-423E-9483-239B4B907912",
                     versionEndExcluding: "3.8.3",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
                     matchCriteriaId: "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "F4CFF558-3C47-480D-A2F0-BABF26042943",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "7F6FB57C-2BC7-487C-96DD-132683AEB35D",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.",
      },
      {
         lang: "es",
         value: "Se encontró una vulnerabilidad en GnuTLS. Los tiempos de respuesta a textos cifrados con formato incorrecto en RSA-PSK ClientKeyExchange difieren de los tiempos de respuesta de textos cifrados con el relleno PKCS#1 v1.5 correcto. Este problema puede permitir que un atacante remoto realice un ataque de canal lateral de sincronización en el intercambio de claves RSA-PSK, lo que podría provocar la fuga de datos confidenciales. CVE-2024-0553 está designado como una resolución incompleta para CVE-2023-5981.",
      },
   ],
   id: "CVE-2024-0553",
   lastModified: "2024-11-21T08:46:51.507",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-01-16T12:15:45.557",
   references: [
      {
         source: "secalert@redhat.com",
         url: "https://access.redhat.com/errata/RHSA-2024:0533",
      },
      {
         source: "secalert@redhat.com",
         url: "https://access.redhat.com/errata/RHSA-2024:0627",
      },
      {
         source: "secalert@redhat.com",
         url: "https://access.redhat.com/errata/RHSA-2024:0796",
      },
      {
         source: "secalert@redhat.com",
         url: "https://access.redhat.com/errata/RHSA-2024:1082",
      },
      {
         source: "secalert@redhat.com",
         url: "https://access.redhat.com/errata/RHSA-2024:1108",
      },
      {
         source: "secalert@redhat.com",
         url: "https://access.redhat.com/errata/RHSA-2024:1383",
      },
      {
         source: "secalert@redhat.com",
         url: "https://access.redhat.com/errata/RHSA-2024:2094",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://access.redhat.com/security/cve/CVE-2024-0553",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=2258412",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Exploit",
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://gitlab.com/gnutls/gnutls/-/issues/1522",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.gnupg.org/pipermail/gnutls-help/2024-January/004841.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.openwall.com/lists/oss-security/2024/01/19/3",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://access.redhat.com/errata/RHSA-2024:0533",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://access.redhat.com/errata/RHSA-2024:0627",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://access.redhat.com/errata/RHSA-2024:0796",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://access.redhat.com/errata/RHSA-2024:1082",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://access.redhat.com/errata/RHSA-2024:1108",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://access.redhat.com/errata/RHSA-2024:1383",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://access.redhat.com/errata/RHSA-2024:2094",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://access.redhat.com/security/cve/CVE-2024-0553",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=2258412",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://gitlab.com/gnutls/gnutls/-/issues/1522",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.debian.org/debian-lts-announce/2024/02/msg00010.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZEIOLORQ7N6WRPFXZSYDL2MC4LP7VFV/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNXKVR5YNUEBNHAHM5GSYKBZX4W2HMN2/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.gnupg.org/pipermail/gnutls-help/2024-January/004841.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://security.netapp.com/advisory/ntap-20240202-0011/",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-203",
            },
         ],
         source: "secalert@redhat.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-203",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "C0AB4B12-05D9-4428-8238-50A4C77AFADD",
                     versionEndIncluding: "2.9.9",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is (1) not yet valid or (2) no longer valid.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad en GnuTLS en versiones anteriores a 2.9.10, no verifica las fechas de activación y expiración de certificados CA, lo que permite a atacantes man-in-the-middle suplantar servidores a través de un certificado expedido por un certificado CA que (1) aún no es válido o (2) ya no es válido.",
      },
   ],
   id: "CVE-2014-8155",
   lastModified: "2025-04-12T10:46:40.837",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2015-08-14T18:59:01.347",
   references: [
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2015-1457.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.securityfocus.com/bid/73317",
      },
      {
         source: "secalert@redhat.com",
         url: "https://gitlab.com/gnutls/gnutls/commit/897cbce62c0263a498088ac3e465aa5f05f8719c",
      },
      {
         source: "secalert@redhat.com",
         url: "https://support.f5.com/csp/article/K53330207",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-1457.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securityfocus.com/bid/73317",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://gitlab.com/gnutls/gnutls/commit/897cbce62c0263a498088ac3e465aa5f05f8719c",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://support.f5.com/csp/article/K53330207",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-17",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.3.0:-:*:*:*:*:*:*",
                     matchCriteriaId: "BE31FE31-3F85-41F3-9DCB-58A090E63DEA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.3.0:pre0:*:*:*:*:*:*",
                     matchCriteriaId: "18A0842D-2CAC-4372-80D0-68BCCC28C7BF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.3.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "A91948CE-E418-4450-AB62-9078D3A0FBEE",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.3.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "D34267DC-A768-4A0F-BB54-74314B70E4F9",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.3.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "160B3AD7-37A3-4A01-B1CD-83E6500E145A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.3.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "BCE61F19-A2C3-4FE9-9C5A-D1FB949B6CEE",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.3.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "5EDFE7E2-12FC-4819-8615-F76A312E8BEE",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.3.6:*:*:*:*:*:*:*",
                     matchCriteriaId: "4993D25F-607B-4486-B9EC-566A1EEBE73B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.3.7:*:*:*:*:*:*:*",
                     matchCriteriaId: "9FEF4D26-DD0C-4E67-8901-8B38A51C1FED",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.3.8:*:*:*:*:*:*:*",
                     matchCriteriaId: "49CE4BAE-77EC-469D-9FE2-A807B7E2EC64",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.3.9:*:*:*:*:*:*:*",
                     matchCriteriaId: "7921C926-450B-4EFF-B610-B8B8FD17AE1A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.3.10:*:*:*:*:*:*:*",
                     matchCriteriaId: "199F787B-0515-442A-8FFA-7A2D8E145792",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.3.11:*:*:*:*:*:*:*",
                     matchCriteriaId: "E6916156-380B-4BF5-A070-8710F728C62D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.3.12:*:*:*:*:*:*:*",
                     matchCriteriaId: "20A990DC-4934-4466-978B-26105AD2DAC1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.3.13:*:*:*:*:*:*:*",
                     matchCriteriaId: "DEE96D17-4EBB-4AA1-AC55-28E65F18A5A1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.3.14:*:*:*:*:*:*:*",
                     matchCriteriaId: "F93C125C-331E-450B-879B-2444AE32E022",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.3.15:*:*:*:*:*:*:*",
                     matchCriteriaId: "924DABC9-8131-4280-8151-26DC08078E1B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.3.16:*:*:*:*:*:*:*",
                     matchCriteriaId: "31B28D33-61C9-4A83-B9FF-31EF7A8DB195",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.4.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9F4DFB1F-772E-4514-B0EC-66923F422797",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.4.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "537DB088-69A7-4482-A639-F3F4C44CA79C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.4.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "A8F38611-4E74-4180-844C-CBD2C3230684",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:3.4.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "461EA8A4-C0C0-4F21-89A0-EACAB34C4C18",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de liberación doble en GnuTLS en versiones anteriores a la 3.3.17 y 3.4.x versiones anteriores a 3.4.4, permite a atacantes remotos causar una denegación de servicio a través de una entrada DistinguishedName (DN) de gran longitud en un certificado.",
      },
   ],
   evaluatorComment: "<a href=\"http://cwe.mitre.org/data/definitions/415.html\">CWE-415: Double Free</a>",
   id: "CVE-2015-6251",
   lastModified: "2025-04-12T10:46:40.837",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 5,
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2015-08-24T14:59:10.947",
   references: [
      {
         source: "secalert@redhat.com",
         url: "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165286.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://lists.opensuse.org/opensuse-updates/2015-09/msg00001.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.debian.org/security/2015/dsa-3334",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://www.gnutls.org/security.html#GNUTLS-SA-2015-3",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.openwall.com/lists/oss-security/2015/08/10/1",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.openwall.com/lists/oss-security/2015/08/17/6",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.securityfocus.com/bid/76267",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.securitytracker.com/id/1033226",
      },
      {
         source: "secalert@redhat.com",
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1251902",
      },
      {
         source: "secalert@redhat.com",
         url: "https://gitlab.com/gnutls/gnutls/commit/272854367efc130fbd4f1a51840d80c630214e12",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165286.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://lists.opensuse.org/opensuse-updates/2015-09/msg00001.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.debian.org/security/2015/dsa-3334",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://www.gnutls.org/security.html#GNUTLS-SA-2015-3",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.openwall.com/lists/oss-security/2015/08/10/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.openwall.com/lists/oss-security/2015/08/17/6",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securityfocus.com/bid/76267",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securitytracker.com/id/1033226",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1251902",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://gitlab.com/gnutls/gnutls/commit/272854367efc130fbd4f1a51840d80c630214e12",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "NVD-CWE-Other",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "C30D5FDF-10E2-42E3-8D48-3BC6BEB0EFE2",
                     versionEndIncluding: "2.12.24",
                     versionStartIncluding: "2.0.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "16F59A04-14CF-49E2-9973-645477EA09DA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "DEECE5FC-CACF-4496-A3E7-164736409252",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "GnuTLS incorrectly validates the first byte of padding in CBC modes",
      },
      {
         lang: "es",
         value: "GnuTLS comprueba incorrectamente el primer byte de relleno en los modos CBC",
      },
   ],
   id: "CVE-2015-8313",
   lastModified: "2024-11-21T02:38:16.517",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:M/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 5.9,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.2,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2019-12-20T14:15:11.523",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "http://www.debian.org/security/2015/dsa-3408",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/archive/1/537012/100/0/threaded",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/78327",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://blog.hboeck.de/archives/877-A-little-POODLE-left-in-GnuTLS-old-versions.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-8313",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2015-8313",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security-tracker.debian.org/tracker/CVE-2015-8313",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "http://www.debian.org/security/2015/dsa-3408",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/archive/1/537012/100/0/threaded",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/78327",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://blog.hboeck.de/archives/877-A-little-POODLE-left-in-GnuTLS-old-versions.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-8313",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2015-8313",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security-tracker.debian.org/tracker/CVE-2015-8313",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-203",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "ECA0072D-DE2F-467F-9143-371A8CCB9000",
                     versionEndExcluding: "3.6.12",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "33C068A4-3780-4EAB-A937-6082DF847564",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "51EF4996-72F4-4FA4-814F-F5991E7A8318",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "825ECE2D-E232-46E0-A047-074B34DB1E97",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
                     matchCriteriaId: "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
                     matchCriteriaId: "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*",
                     matchCriteriaId: "07C312A0-CD2C-4B9C-B064-6409B25C278F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*",
                     matchCriteriaId: "CD783B0C-9246-47D9-A937-6144FE8BFF0F",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
                     matchCriteriaId: "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
                     matchCriteriaId: "36D96259-24BD-44E2-96D9-78CE1D41F956",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets.",
      },
      {
         lang: "es",
         value: "Se ha detectado que la implementación GnuTLS de HMAC-SHA-256 era vulnerable a un ataque de estilo Lucky Thirteen. Los atacantes remotos podrían utilizar este fallo para realizar ataques de distinción y de recuperación en texto plano mediante análisis estadísticos de datos temporales mediante paquetes manipulados.",
      },
   ],
   id: "CVE-2018-10844",
   lastModified: "2024-11-21T03:42:07.573",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:M/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 5.9,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.2,
            impactScore: 3.6,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 5.9,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.2,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2018-08-22T13:29:00.317",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/105138",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2018:3050",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Broken Link",
         ],
         url: "https://access.redhat.com/errata/RHSA-2018:3505",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10844",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://eprint.iacr.org/2018/747",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://gitlab.com/gnutls/gnutls/merge_requests/657",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2018/10/msg00022.html",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ/",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDYY3R4F5CUTFAMXH2C5NKYFVDEJLTT7/",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://usn.ubuntu.com/3999-1/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/105138",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2018:3050",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "https://access.redhat.com/errata/RHSA-2018:3505",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10844",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://eprint.iacr.org/2018/747",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://gitlab.com/gnutls/gnutls/merge_requests/657",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2018/10/msg00022.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDYY3R4F5CUTFAMXH2C5NKYFVDEJLTT7/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://usn.ubuntu.com/3999-1/",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-385",
            },
         ],
         source: "secalert@redhat.com",
         type: "Primary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-327",
            },
         ],
         source: "nvd@nist.gov",
         type: "Secondary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "E314F586-A086-480E-9BB9-D75ADDF8416D",
                     versionEndIncluding: "1.2.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.0.16:*:*:*:*:*:*:*",
                     matchCriteriaId: "4FBB8F2C-498D-4D31-A7D7-9991BABEA7A6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.0.17:*:*:*:*:*:*:*",
                     matchCriteriaId: "8856E1B1-8007-42E5-82EF-4700D4DEEDDA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.0.18:*:*:*:*:*:*:*",
                     matchCriteriaId: "A9CF40D3-CE03-4C2A-8EEF-EB5989291806",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.0.19:*:*:*:*:*:*:*",
                     matchCriteriaId: "EC60D4CC-922C-4941-A400-0CBEAC7F31D1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.0.20:*:*:*:*:*:*:*",
                     matchCriteriaId: "754A0D19-A17A-4007-8355-497D14CFCBF9",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.0.21:*:*:*:*:*:*:*",
                     matchCriteriaId: "8140DBE1-8116-4051-9A57-07535586E0AF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.0.22:*:*:*:*:*:*:*",
                     matchCriteriaId: "56D2DF7F-DCDD-486D-B906-F9DDE3A1DB70",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.0.23:*:*:*:*:*:*:*",
                     matchCriteriaId: "F1CC840D-AD01-4EE2-8652-06742A6286BA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.0.24:*:*:*:*:*:*:*",
                     matchCriteriaId: "84224A82-6D58-4000-A449-20C1632DAE85",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.0.25:*:*:*:*:*:*:*",
                     matchCriteriaId: "A466931C-769A-4A28-B072-10930CE655E6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.1.13:*:*:*:*:*:*:*",
                     matchCriteriaId: "2FEE50AC-8730-4F04-B57C-6BDF8B957F6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.1.14:*:*:*:*:*:*:*",
                     matchCriteriaId: "10F621DC-7967-4D97-A562-02E7033C89C2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.1.15:*:*:*:*:*:*:*",
                     matchCriteriaId: "776E5481-399F-45BC-AD20-A18508B03916",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.1.16:*:*:*:*:*:*:*",
                     matchCriteriaId: "63D7F972-9128-4A4D-8508-B38CE2F155E9",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.1.17:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5D56873-E8C5-4E4B-BB85-6DCF6526B453",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.1.18:*:*:*:*:*:*:*",
                     matchCriteriaId: "54FE4766-32D0-491E-8C71-5B998C468142",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.1.19:*:*:*:*:*:*:*",
                     matchCriteriaId: "7F980857-2364-466A-8366-BD017D242222",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.1.20:*:*:*:*:*:*:*",
                     matchCriteriaId: "4CDCF1F0-5A78-48FF-B4B0-303AE2420F6A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.1.21:*:*:*:*:*:*:*",
                     matchCriteriaId: "0A2E649D-5C45-4412-927B-E3EDCE07587C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.1.22:*:*:*:*:*:*:*",
                     matchCriteriaId: "066175C2-6E96-4BAE-B1A6-B23D25547FAC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:1.1.23:*:*:*:*:*:*:*",
                     matchCriteriaId: "869D3010-67AE-44D0-BB8F-D9C410AEA1D8",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The gnutls_x509_crt_get_serial function in the GnuTLS library before 1.2.1, when running on big-endian, 64-bit platforms, calls the asn1_read_value with a pointer to the wrong data type and the wrong length value, which allows remote attackers to bypass the certificate revocation list (CRL) check and cause a stack-based buffer overflow via a crafted X.509 certificate, related to extraction of a serial number.",
      },
      {
         lang: "es",
         value: "La función gnutls_x509_crt_get_serial en la librería GnuTLS anterior a v1.2.1, cunado se está ejecutando sobre big-endian, plataformas de 64-bit, llama de a asn1_read_value con un puntero a un tipo de dato erróneo, y con una longitud errónea, lo que permite a atacantes remotos saltarse el control la lista de certificados revocados (CRL) y robocar un desbordamiento de de búfer basado en pila, a a través de un certificado X.509 manipulado, relativo a la extracción de un número de serie.",
      },
   ],
   evaluatorSolution: "Per: http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/4230\r\n\r\n\"Please note that the problem was solved for GnuTLS 1.2.1, released on\r\n2005-04-04.  Also, 32-bit platforms are not affected.  I have added\r\ninformation about this on\r\n\r\nhttp://www.gnu.org/software/gnutls/security.html\r\n\r\nso that it contains the complete list of known security flaws.  I'm\r\nusing the keyword GNUTLS-SA-2010-1 for this.\"",
   id: "CVE-2010-0731",
   lastModified: "2025-04-11T00:51:21.963",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 7.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2010-03-26T18:30:00.437",
   references: [
      {
         source: "secalert@redhat.com",
         url: "http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://secunia.com/advisories/39127",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Exploit",
         ],
         url: "http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/4230",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.mandriva.com/security/advisories?name=MDVSA-2010:089",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.redhat.com/support/errata/RHSA-2010-0167.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.securityfocus.com/bid/38959",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://www.vupen.com/english/advisories/2010/0713",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.vupen.com/english/advisories/2010/1054",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Exploit",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=573028",
      },
      {
         source: "secalert@redhat.com",
         url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9759",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://secunia.com/advisories/39127",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
         ],
         url: "http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/4230",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.mandriva.com/security/advisories?name=MDVSA-2010:089",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.redhat.com/support/errata/RHSA-2010-0167.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securityfocus.com/bid/38959",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://www.vupen.com/english/advisories/2010/0713",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.vupen.com/english/advisories/2010/1054",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=573028",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9759",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-119",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "5CA85285-1376-4569-8EC1-66E1625E258D",
                     versionEndExcluding: "2.6.1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*",
                     matchCriteriaId: "72E4DB7F-07C3-46BB-AAA2-05CD0312C57F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*",
                     matchCriteriaId: "743CBBB1-C140-4FEF-B40E-FAE4511B1140",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*",
                     matchCriteriaId: "454A5D17-B171-4F1F-9E0B-F18D1E5CA9FD",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*",
                     matchCriteriaId: "823BF8BE-2309-4F67-A5E2-EAD98F723468",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*",
                     matchCriteriaId: "7EBFE35C-E243-43D1-883D-4398D71763CC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*",
                     matchCriteriaId: "4747CC68-FAF4-482F-929A-9DA6C24CB663",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "0F92AB32-E7DE-43F4-B877-1F41FA162EC7",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:opensuse:opensuse:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FF141FBE-4CA5-4695-94A0-8BE1309D28CC",
                     versionEndIncluding: "11.1",
                     versionStartIncluding: "10.3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:suse:linux_enterprise:10.0:-:*:*:*:*:*:*",
                     matchCriteriaId: "AED08A6F-CD23-4405-B1CF-C96BB8AE7D6B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:suse:linux_enterprise:11.0:-:*:*:*:*:*:*",
                     matchCriteriaId: "1608E282-2E96-4447-848D-DBE915DB0EF9",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:suse:linux_enterprise_server:10:-:*:*:*:*:*:*",
                     matchCriteriaId: "38C3AEB0-59E2-400A-8943-60C0A223B680",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*",
                     matchCriteriaId: "F13F07CC-739B-465C-9184-0E9D708BD4C7",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).",
      },
      {
         lang: "es",
         value: "La función _gnutls_x509_verify_certificate en lib/x509/verify.c en libgnutls en GnuTLS antes de v2.6.1 confía en las cadenas de certificado en las que el último certificado es un certificado de confianza arbitraria, auto-firmado, lo que permite a atacantes de tipo \"hombre en el medio\" (man-in-the-middle) insertar un certificado falso para cualquier Distinguished Name(DN).",
      },
   ],
   id: "CVE-2008-4989",
   lastModified: "2025-04-09T00:30:58.490",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 5.9,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.2,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2008-11-13T01:00:01.177",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
            "Patch",
         ],
         url: "http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3215",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
         ],
         url: "http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/32619",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
         ],
         url: "http://secunia.com/advisories/32681",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
         ],
         url: "http://secunia.com/advisories/32687",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
         ],
         url: "http://secunia.com/advisories/32879",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
         ],
         url: "http://secunia.com/advisories/33501",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
         ],
         url: "http://secunia.com/advisories/33694",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
         ],
         url: "http://secunia.com/advisories/35423",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "http://security.gentoo.org/glsa/glsa-200901-10.xml",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
         ],
         url: "http://sunsolve.sun.com/search/document.do?assetkey=1-26-260528-1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
         ],
         url: "http://wiki.rpath.com/Advisories:rPSA-2008-0322",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "http://www.debian.org/security/2009/dsa-1719",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Product",
         ],
         url: "http://www.gnu.org/software/gnutls/security.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
         ],
         url: "http://www.mandriva.com/security/advisories?name=MDVSA-2008:227",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
         ],
         url: "http://www.redhat.com/support/errata/RHSA-2008-0982.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/archive/1/498431/100/0/threaded",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
            "Patch",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/32232",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securitytracker.com/id?1021167",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "http://www.ubuntu.com/usn/usn-678-2",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
         ],
         url: "http://www.vupen.com/english/advisories/2008/3086",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
         ],
         url: "http://www.vupen.com/english/advisories/2009/1567",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/46482",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
         ],
         url: "https://issues.rpath.com/browse/RPL-2886",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
         ],
         url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11650",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Broken Link",
         ],
         url: "https://usn.ubuntu.com/678-1/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00222.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00293.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
            "Patch",
         ],
         url: "http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3215",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/32619",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "http://secunia.com/advisories/32681",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "http://secunia.com/advisories/32687",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "http://secunia.com/advisories/32879",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "http://secunia.com/advisories/33501",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "http://secunia.com/advisories/33694",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "http://secunia.com/advisories/35423",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "http://security.gentoo.org/glsa/glsa-200901-10.xml",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "http://sunsolve.sun.com/search/document.do?assetkey=1-26-260528-1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "http://wiki.rpath.com/Advisories:rPSA-2008-0322",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "http://www.debian.org/security/2009/dsa-1719",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Product",
         ],
         url: "http://www.gnu.org/software/gnutls/security.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "http://www.mandriva.com/security/advisories?name=MDVSA-2008:227",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "http://www.redhat.com/support/errata/RHSA-2008-0982.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/archive/1/498431/100/0/threaded",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
            "Patch",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/32232",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securitytracker.com/id?1021167",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "http://www.ubuntu.com/usn/usn-678-2",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "http://www.vupen.com/english/advisories/2008/3086",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "http://www.vupen.com/english/advisories/2009/1567",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/46482",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "https://issues.rpath.com/browse/RPL-2886",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11650",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "https://usn.ubuntu.com/678-1/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00222.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00293.html",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-295",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}