Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-1959

lib/x509/verify.c in GnuTLS before 3.1.21 and 3.2.x before 3.2.11 treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates.

Published

2014-03-07T00:10:57.620

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 5.8 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

4.9

Weaknesses
  • Type: Primary
    CWE-264
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application gnu gnutls ≤ 3.1.20 Yes
Application gnu gnutls 3.1.0 Yes
Application gnu gnutls 3.1.1 Yes
Application gnu gnutls 3.1.2 Yes
Application gnu gnutls 3.1.3 Yes
Application gnu gnutls 3.1.4 Yes
Application gnu gnutls 3.1.5 Yes
Application gnu gnutls 3.1.6 Yes
Application gnu gnutls 3.1.7 Yes
Application gnu gnutls 3.1.8 Yes
Application gnu gnutls 3.1.9 Yes
Application gnu gnutls 3.1.10 Yes
Application gnu gnutls 3.1.11 Yes
Application gnu gnutls 3.1.12 Yes
Application gnu gnutls 3.1.13 Yes
Application gnu gnutls 3.1.14 Yes
Application gnu gnutls 3.1.15 Yes
Application gnu gnutls 3.1.16 Yes
Application gnu gnutls 3.1.17 Yes
Application gnu gnutls 3.1.18 Yes
Application gnu gnutls 3.1.19 Yes
Application gnu gnutls ≤ 3.2.10 Yes
Application gnu gnutls 3.2.0 Yes
Application gnu gnutls 3.2.1 Yes
Application gnu gnutls 3.2.2 Yes
Application gnu gnutls 3.2.3 Yes
Application gnu gnutls 3.2.4 Yes
Application gnu gnutls 3.2.5 Yes
Application gnu gnutls 3.2.6 Yes
Application gnu gnutls 3.2.7 Yes
Application gnu gnutls 3.2.8 Yes
Application gnu gnutls 3.2.8.1 Yes
Application gnu gnutls 3.2.9 Yes
References