CVE-2008-4989

Synopsis Moderate: gnutls security update Type/Severity Security Advisory: Moderate Topic Updated gnutls packages that fix a security issue are now available for RedHat Enterprise Linux 5This update has been rated as having moderate security impact by the RedHat Security Response Team Description ...

Martin von Gagern discovered that GNUTLS, an implementation of the TLS/SSL protocol, handles verification of X509 certificate chains incorrectly if a self-signed certificate is configured as a trusted certificate This could cause clients to accept forged server certificates as genuine (CVE-2008-4989) In addition, this update tightens the checks ...

Moxie Marlinspike and Dan Kaminsky independently discovered that GnuTLS did not properly handle certificates with NULL characters in the certificate name An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications (CVE-2009-2730) ...

USN-678-1 fixed a vulnerability in GnuTLS The upstream patch introduced a regression when validating certain certificate chains that would report valid certificates as untrusted This update fixes the problem ...

Martin von Gagern discovered that GnuTLS did not properly verify certificate chains when the last certificate in the chain was self-signed If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to view sensitive information (CVE-2008-4989) ...