CVEvulnerability
CVE-2009-1416
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2009-04-30
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-310
Description
lib/gnutls_pk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the intended DSA keys, which might allow remote attackers to spoof signatures on certificates or have unspecified other impact by leveraging an invalid DSA key.
Affected configurations
• gnu gnutls 2.5.0
• gnu gnutls 2.6.0
• gnu gnutls 2.6.1
• gnu gnutls 2.6.2
• gnu gnutls 2.6.3
• gnu gnutls 2.6.4
• gnu gnutls 2.6.5
Related
Weakness · not in database (1)
References
- http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516 Exploit, Patch
- http://lists.gnu.org/archive/html/help-gnutls/2009-04/msg00018.html Vendor Advisory
- http://secunia.com/advisories/34842 Vendor Advisory
- http://secunia.com/advisories/35211 secunia.com
- http://security.gentoo.org/glsa/glsa-200905-04.xml security.gentoo.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:116 www.mandriva.com
- http://www.securityfocus.com/bid/34783 www.securityfocus.com
- http://www.securitytracker.com/id?1022158 www.securitytracker.com
- http://www.vupen.com/english/advisories/2009/1218 www.vupen.com
- http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516 Exploit, Patch
- http://lists.gnu.org/archive/html/help-gnutls/2009-04/msg00018.html Vendor Advisory
- http://secunia.com/advisories/34842 Vendor Advisory
- http://secunia.com/advisories/35211 secunia.com
- http://security.gentoo.org/glsa/glsa-200905-04.xml security.gentoo.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:116 www.mandriva.com
- http://www.securityfocus.com/bid/34783 www.securityfocus.com
- http://www.securitytracker.com/id?1022158 www.securitytracker.com
- http://www.vupen.com/english/advisories/2009/1218 www.vupen.com