REDHAT-BUG-2423177: Medium severity GNUTLS GNUTLS vulnerability
Verifying Certificates with large amout of name constraints and subject alternative names makes GnuTLS vulnerable to DoS attacks
When trying to verify a certificate chain using the certtool --verify command, with certificates, that contain a larger number of SANs and Name Constraints, GnuTLS tries to verify all of them, without any bound on the quantity of those fields. Using those crafted malicious certificate, GnuTLS is vulnerable to DoS attacks by excessive usage of CPU and memory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2423177?
The vulnerability REDHAT-BUG-2423177 is classified as a DoS (Denial of Service) risk due to its potential to make GnuTLS unresponsive when verifying certain certificates.
How do I fix REDHAT-BUG-2423177?
To mitigate the effects of REDHAT-BUG-2423177, it is recommended to update GnuTLS to the latest version that addresses this vulnerability.
What causes the vulnerability REDHAT-BUG-2423177?
REDHAT-BUG-2423177 is caused by GnuTLS attempting to verify certificates with an excessive number of Subject Alternative Names (SANs) and Name Constraints, leading to resource exhaustion.
Which software is affected by REDHAT-BUG-2423177?
The vulnerability REDHAT-BUG-2423177 affects GnuTLS, specifically when using the certtool --verify command with certain problematic certificates.
What should I do if I am using an application that relies on GnuTLS affected by REDHAT-BUG-2423177?
If your application relies on GnuTLS, ensure you apply the necessary updates to GnuTLS to prevent potential Denial of Service incidents due to REDHAT-BUG-2423177.