F5-K000163778: High severity F5 F5 Insight vulnerability
A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.1.1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker would need to present a certificate with an oversized Subject Alternative Name during certificate validation. Exploitation can be performed remotely and does not require privileges or user interaction.
What is the likely security impact if exploitation succeeds?
Certificate validation may fall back to the Common Name field instead of properly validating the Subject Alternative Name. This can enable certificate spoofing or a man-in-the-middle attack, with high integrity impact and low confidentiality impact.