CVE-2015-0294: High severity gnutls vulnerability
GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.
Other sources
It was reported that all versions of GnuTLS did not check whether the two signature algorithms match on certificate import.
There are no known attacks that could lead to a forged certificate because of that, but the possibility of it is not eliminated either (it depends on whether there can be cross-signature attacks).
Upstream commit that fix this:
https://gitlab.com/gnutls/gnutls/commit/6e76e9b9fa845b76b0b9a45f05f4b54a052578ff
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0294?
CVE-2015-0294 is considered a moderate severity vulnerability due to the potential for mismatched signature algorithms during certificate import.
How do I fix CVE-2015-0294?
To fix CVE-2015-0294, update GnuTLS to version 3.3.13 or later to ensure proper validation of signature algorithms.
Which versions of GnuTLS are affected by CVE-2015-0294?
All versions of GnuTLS prior to 3.3.13 are affected by CVE-2015-0294.
Does CVE-2015-0294 allow for certificate forgery?
There are currently no known exploitations of CVE-2015-0294 that could lead to forged certificates.
What platforms are impacted by CVE-2015-0294?
CVE-2015-0294 affects GnuTLS on various platforms including Debian and Red Hat Enterprise Linux versions prior to the patched version.