CVE-2015-0282
Fixed in a distro release EPSS 1%
GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
Products: gnutls
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 6.0 | gnutls26 | 2.8.6-1+squeeze5 |
| Debian 7 | gnutls26 | 2.12.20-8+deb7u3 |
| Red Hat Enterprise Linux 6 | gnutls | 0:2.8.5-18.el6 |
| Red Hat Enterprise Linux 6 | gnutls-debuginfo | 0:2.8.5-18.el6 |
| Red Hat Enterprise Linux 6 | gnutls-devel | 0:2.8.5-18.el6 |
| Red Hat Enterprise Linux 6 | gnutls-guile | 0:2.8.5-18.el6 |
| Red Hat Enterprise Linux 6 | gnutls-utils | 0:2.8.5-18.el6 |
| Ubuntu 14.04 LTS | gnutls26 | 2.12.23-12ubuntu2.2 |