Solution
Please Install the Updated Packages.
Insight
The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS).
A flaw was discovered in the way GnuTLS handles NULL characters in certain fields of X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a Certificate Authority trusted by an application using GnuTLS, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse the application into accepting it by mistake. (CVE-2009-2730)
Users of GnuTLS are advised to upgrade to these updated packages, which contain a backported patch that corrects this issue.
Affected
gnutls on CentOS 4
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2009-2730 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities