Debian Security Advisory DSA 2866-1 (gnutls26 - Certificate Verification Flaw) Network Vulnerability

Summary

Suman Jana reported that GnuTLS, deviating from the documented behavior, considers a version 1 intermediate certificate as a CA certificate by default. The oldstable distribution (squeeze) is not affected by this problem as X.509 version 1 trusted CA certificates are not allowed by default.

Solution

For the stable distribution (wheezy), this problem has been fixed in version 2.12.20-8. For the testing distribution (jessie) and the unstable distribution (sid), this problem has been fixed in version 2.12.23-12. We recommend that you upgrade your gnutls26 packages.

Insight

gnutls is a portable library which implements the Transport Layer Security (TLS) 1.0 and Secure Sockets Layer (SSL) 3.0 protocols.

Affected

gnutls26 on Debian Linux

Detection

This check tests the installed software version using the apt package manager.

References