CVE-2014-8155
Fixed in a distro release EPSS 1%
GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is (1) not yet valid or (2) no longer valid.
Products: gnutls
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 6.0 | gnutls26 | 2.8.6-1+squeeze5 |
| Red Hat Enterprise Linux 6 | gnutls | 0:2.8.5-18.el6 |
| Red Hat Enterprise Linux 6 | gnutls-debuginfo | 0:2.8.5-18.el6 |
| Red Hat Enterprise Linux 6 | gnutls-devel | 0:2.8.5-18.el6 |
| Red Hat Enterprise Linux 6 | gnutls-guile | 0:2.8.5-18.el6 |
| Red Hat Enterprise Linux 6 | gnutls-utils | 0:2.8.5-18.el6 |
| Ubuntu 14.04 LTS | gnutls26 | 2.12.23-12ubuntu2.2 |