CVE-2014-1959: Medium severity GNU GnuTLS vulnerability
It was reported [1] that a version 1 intermediate certificate would be considered as a CA certificate by GnuTLS by default. This certificate verification behaviour deviates from the documented behaviour.
Upstream notes that this only affects individuals or organizations who have a CA that issues X.509 version 1 certificates in their trusted list.
This has been fixed upstream [2] in version 3.1.21 and 3.2.11.
At a quick look at the code of GnuTLS 2.8.5, it is affected. 1.4.1 looks affected to me as well.
[1] http://www.gnutls.org/security.html [2] https://www.gitorious.org/gnutls/gnutls/commit/b1abfe3d18
Other sources
lib/x509/verify.c in GnuTLS before 3.1.21 and 3.2.x before 3.2.11 treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/gnutlsto a version that resolves this vulnerability.Fixed in 3.1.21 - Upgrade
Upgrade
redhat/gnutlsto a version that resolves this vulnerability.Fixed in 3.2.11 - Upgrade
Upgrade
gnutlsto a version that resolves this vulnerability.Fixed in 3.1.21 - Upgrade
Upgrade
gnutlsto a version that resolves this vulnerability.Fixed in 3.2.11 - Configuration
Update GnuTLS to a version where certificate verification no longer treats X.509 version 1 certificates as intermediate CAs (fixed upstream in 3.1.21 and 3.2.11).
lib/x509/verify.c (GnuTLS certificate verification) treat version 1 X.509 certificates as intermediate CAs = disabled (so version 1 X.509 certificates are not treated as intermediate CAs)
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1959?
CVE-2014-1959 has been classified as a moderate severity vulnerability.
How do I fix CVE-2014-1959?
To resolve CVE-2014-1959, update GnuTLS to version 3.1.21 or higher or 3.2.11 or higher.
Which versions of GnuTLS are affected by CVE-2014-1959?
CVE-2014-1959 affects GnuTLS versions prior to 3.1.21 and 3.2.11.
What type of vulnerability is CVE-2014-1959?
CVE-2014-1959 is a certificate validation vulnerability that involves incorrect handling of version 1 intermediate certificates.
Does CVE-2014-1959 affect all users of GnuTLS?
No, CVE-2014-1959 primarily affects users whose certificate authorities issue version 1 intermediate certificates.