CVEvulnerability
CVE-2016-7444
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2016-09-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-264
Description
The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc.
Affected configurations
• gnu gnutls (<= 3.4.14)
• gnu gnutls 3.5.0
• gnu gnutls 3.5.1
• gnu gnutls 3.5.2
• gnu gnutls 3.5.3
Related
Weakness · not in database (1)
References
- http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html lists.opensuse.org
- http://www.securityfocus.com/bid/92893 www.securityfocus.com
- https://access.redhat.com/errata/RHSA-2017:2292 access.redhat.com
- https://gitlab.com/gnutls/gnutls/commit/964632f37dfdfb914ebc5e49db4fa29af35b1de9 Patch
- https://lists.gnupg.org/pipermail/gnutls-devel/2016-September/008146.html Mailing List, Third Party Advisory
- https://www.gnutls.org/security.html Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html lists.opensuse.org
- http://www.securityfocus.com/bid/92893 www.securityfocus.com
- https://access.redhat.com/errata/RHSA-2017:2292 access.redhat.com
- https://gitlab.com/gnutls/gnutls/commit/964632f37dfdfb914ebc5e49db4fa29af35b1de9 Patch
- https://lists.gnupg.org/pipermail/gnutls-devel/2016-September/008146.html Mailing List, Third Party Advisory
- https://www.gnutls.org/security.html Vendor Advisory