CVEvulnerability

CVE-2012-5821

5.9 MEDIUM Published 2012-11-04 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2012-11-04
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 3.1 ([email protected]): 5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected]): 5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
Weaknesses: CWE-295

Description

Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to improper use of a certain GnuTLS function.

Affected configurations

• lynx lynx • canonical ubuntu linux 10.04 • canonical ubuntu linux 11.10 • canonical ubuntu linux 12.04 • canonical ubuntu linux 12.10

Weakness · CWE (1)

CWE-295 Improper Certificate Validation weakness

Referenced by CWE · observed example (2)

CWE-295 Improper Certificate Validation weakness
CWE-296 Improper Following of a Certificate's Chain of Trust weakness

References

http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf Exploit
http://www.mandriva.com/security/advisories?name=MDVSA-2013:101 Broken Link
http://www.ubuntu.com/usn/USN-1642-1 Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/79930 Third Party Advisory, VDB Entry
https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0351 Third Party Advisory
http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf Exploit
http://www.mandriva.com/security/advisories?name=MDVSA-2013:101 Broken Link
http://www.ubuntu.com/usn/USN-1642-1 Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/79930 Third Party Advisory, VDB Entry
https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0351 Third Party Advisory