CVE-2015-7542: Medium severity gwenhywfar vulnerability
A vulnerability exists in libgwenhywfar through 4.12.0 due to the usage of outdated bundled CA certificates.
Other sources
gwenhywfar (all versions of Fedora and EPEL) uses an old bundled ca-certificates (version 1.87). The attached patch for rawhide fixes this; scratch build:
http://koji.fedoraproject.org/koji/taskinfo?taskID=11475516 (F22)
Note that gwenhywfar does not currently build in F23 and rawhide due to bug 1239551 (gnutls-3.4 API changes).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7542?
CVE-2015-7542 has a low severity rating due to the outdated bundled CA certificates, which may expose users to potential man-in-the-middle attacks.
How do I fix CVE-2015-7542?
To fix CVE-2015-7542, update the libgwenhywfar package to the latest version that uses updated CA certificates.
Which versions of gwenhywfar are affected by CVE-2015-7542?
CVE-2015-7542 affects all versions of gwenhywfar up to and including 4.12.0.
What systems are impacted by CVE-2015-7542?
CVE-2015-7542 impacts systems running Fedora, Debian versions 8.0 through 11.0, and openSUSE versions 42.2 and 42.3.
Is there any patch available for CVE-2015-7542?
Yes, a patch for CVE-2015-7542 is available in rawhide to update the bundled CA certificates.