CVE-2014-8564: Medium severity gnutls vulnerability
IssueDescription:
An out-of-bounds memory write flaw was found in the way GnuTLS parsed certain ECC (Elliptic Curve Cryptography) certificates or certificate signing requests (CSR). A malicious user could create a specially crafted ECC certificate or a certificate signing request that, when processed by an application compiled against GnuTLS (for example, certtool), could cause that application to crash or execute arbitrary code with the permissions of the user running the application.
Other sources
The gnutlseccansix963export function in gnutlsecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8564?
CVE-2014-8564 is classified as a high severity vulnerability due to its potential to cause an out-of-bounds memory write.
How do I fix CVE-2014-8564?
To fix CVE-2014-8564, upgrade your GnuTLS to version 3.1.28, 3.2.20, or 3.3.10 or later.
What systems are affected by CVE-2014-8564?
CVE-2014-8564 affects various GnuTLS versions across different distributions including Red Hat and openSUSE.
What types of attacks exploit CVE-2014-8564?
CVE-2014-8564 can be exploited by attackers creating specially crafted ECC certificates or certificate signing requests.
Is there a patch available for CVE-2014-8564?
Yes, patches for CVE-2014-8564 are included in the updated GnuTLS versions that resolve the vulnerability.