ByteOS Network

NVD Vulnerability Details :

CVE-2008-4989

Modified

Source-cve@mitre.org

Published At-13 Nov, 2008 | 01:00

Updated At-23 Apr, 2026 | 00:35

The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 3.1

Base score: 5.9

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

GNU

>>gnutls>>Versions before 2.6.1(exclusive)

cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:*

Fedora Project

>>fedora>>8

cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*

Fedora Project

>>fedora>>9

cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*

Canonical Ltd.

>>ubuntu_linux>>6.06

cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*

Canonical Ltd.

>>ubuntu_linux>>7.10

cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*

Canonical Ltd.

>>ubuntu_linux>>8.04

cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*

Canonical Ltd.

>>ubuntu_linux>>8.10

cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*

Debian GNU/Linux

>>debian_linux>>4.0

cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*

openSUSE

>>opensuse>>Versions from 10.3(inclusive) to 11.1(inclusive)

cpe:2.3:o:opensuse:opensuse:*:*:*:*:*:*:*:*

SUSE

>>linux_enterprise>>10.0

cpe:2.3:o:suse:linux_enterprise:10.0:-:*:*:*:*:*:*

SUSE

>>linux_enterprise>>11.0

cpe:2.3:o:suse:linux_enterprise:11.0:-:*:*:*:*:*:*

SUSE

>>linux_enterprise_server>>10

cpe:2.3:o:suse:linux_enterprise_server:10:-:*:*:*:*:*:*

SUSE

>>linux_enterprise_server>>11

cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-295	Primary	nvd@nist.gov

CWE ID: CWE-295

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3215	cve@mitre.org	Broken Link Patch
http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217	cve@mitre.org	Broken Link
http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html	cve@mitre.org	Mailing List
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html	cve@mitre.org	Mailing List
http://secunia.com/advisories/32619	cve@mitre.org	Broken Link Vendor Advisory
http://secunia.com/advisories/32681	cve@mitre.org	Broken Link
http://secunia.com/advisories/32687	cve@mitre.org	Broken Link
http://secunia.com/advisories/32879	cve@mitre.org	Broken Link
http://secunia.com/advisories/33501	cve@mitre.org	Broken Link
http://secunia.com/advisories/33694	cve@mitre.org	Broken Link
http://secunia.com/advisories/35423	cve@mitre.org	Broken Link
http://security.gentoo.org/glsa/glsa-200901-10.xml	cve@mitre.org	Third Party Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-260528-1	cve@mitre.org	Broken Link
http://wiki.rpath.com/Advisories:rPSA-2008-0322	cve@mitre.org	Broken Link
http://www.debian.org/security/2009/dsa-1719	cve@mitre.org	Mailing List
http://www.gnu.org/software/gnutls/security.html	cve@mitre.org	Product
http://www.mandriva.com/security/advisories?name=MDVSA-2008:227	cve@mitre.org	Broken Link
http://www.redhat.com/support/errata/RHSA-2008-0982.html	cve@mitre.org	Broken Link
http://www.securityfocus.com/archive/1/498431/100/0/threaded	cve@mitre.org	Broken Link Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/32232	cve@mitre.org	Broken Link Patch Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1021167	cve@mitre.org	Broken Link Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/usn-678-2	cve@mitre.org	Third Party Advisory
http://www.vupen.com/english/advisories/2008/3086	cve@mitre.org	Broken Link
http://www.vupen.com/english/advisories/2009/1567	cve@mitre.org	Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/46482	cve@mitre.org	Third Party Advisory VDB Entry
https://issues.rpath.com/browse/RPL-2886	cve@mitre.org	Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11650	cve@mitre.org	Broken Link
https://usn.ubuntu.com/678-1/	cve@mitre.org	Broken Link
https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00222.html	cve@mitre.org	Mailing List
https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00293.html	cve@mitre.org	Mailing List
http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3215	af854a3a-2127-422b-91ae-364da2661108	Broken Link Patch
http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html	af854a3a-2127-422b-91ae-364da2661108	Mailing List
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html	af854a3a-2127-422b-91ae-364da2661108	Mailing List
http://secunia.com/advisories/32619	af854a3a-2127-422b-91ae-364da2661108	Broken Link Vendor Advisory
http://secunia.com/advisories/32681	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://secunia.com/advisories/32687	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://secunia.com/advisories/32879	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://secunia.com/advisories/33501	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://secunia.com/advisories/33694	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://secunia.com/advisories/35423	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://security.gentoo.org/glsa/glsa-200901-10.xml	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-260528-1	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://wiki.rpath.com/Advisories:rPSA-2008-0322	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://www.debian.org/security/2009/dsa-1719	af854a3a-2127-422b-91ae-364da2661108	Mailing List
http://www.gnu.org/software/gnutls/security.html	af854a3a-2127-422b-91ae-364da2661108	Product
http://www.mandriva.com/security/advisories?name=MDVSA-2008:227	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://www.redhat.com/support/errata/RHSA-2008-0982.html	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://www.securityfocus.com/archive/1/498431/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108	Broken Link Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/32232	af854a3a-2127-422b-91ae-364da2661108	Broken Link Patch Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1021167	af854a3a-2127-422b-91ae-364da2661108	Broken Link Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/usn-678-2	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
http://www.vupen.com/english/advisories/2008/3086	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://www.vupen.com/english/advisories/2009/1567	af854a3a-2127-422b-91ae-364da2661108	Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/46482	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
https://issues.rpath.com/browse/RPL-2886	af854a3a-2127-422b-91ae-364da2661108	Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11650	af854a3a-2127-422b-91ae-364da2661108	Broken Link
https://usn.ubuntu.com/678-1/	af854a3a-2127-422b-91ae-364da2661108	Broken Link
https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00222.html	af854a3a-2127-422b-91ae-364da2661108	Mailing List
https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00293.html	af854a3a-2127-422b-91ae-364da2661108	Mailing List

Hyperlink: http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3215

Source: cve@mitre.org

Resource:

Broken Link

Patch

Hyperlink: http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217

Source: cve@mitre.org

Resource:

Broken Link

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html

Source: cve@mitre.org

Resource:

Mailing List

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html

Source: cve@mitre.org

Resource:

Mailing List

Hyperlink: http://secunia.com/advisories/32619

Source: cve@mitre.org

Resource:

Broken Link

Vendor Advisory

Hyperlink: http://secunia.com/advisories/32681

Source: cve@mitre.org

Resource:

Broken Link

Hyperlink: http://secunia.com/advisories/32687

Source: cve@mitre.org

Resource:

Broken Link

Hyperlink: http://secunia.com/advisories/32879

Source: cve@mitre.org

Resource:

Broken Link

Hyperlink: http://secunia.com/advisories/33501

Source: cve@mitre.org

Resource:

Broken Link

Hyperlink: http://secunia.com/advisories/33694

Source: cve@mitre.org

Resource:

Broken Link

Hyperlink: http://secunia.com/advisories/35423

Source: cve@mitre.org

Resource:

Broken Link

Hyperlink: http://security.gentoo.org/glsa/glsa-200901-10.xml

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: http://sunsolve.sun.com/search/document.do?assetkey=1-26-260528-1

Source: cve@mitre.org

Resource:

Broken Link

Hyperlink: http://wiki.rpath.com/Advisories:rPSA-2008-0322

Source: cve@mitre.org

Resource:

Broken Link

Hyperlink: http://www.debian.org/security/2009/dsa-1719

Source: cve@mitre.org

Resource:

Mailing List

Hyperlink: http://www.gnu.org/software/gnutls/security.html

Source: cve@mitre.org

Resource:

Product

Hyperlink: http://www.mandriva.com/security/advisories?name=MDVSA-2008:227

Source: cve@mitre.org

Resource:

Broken Link

Hyperlink: http://www.redhat.com/support/errata/RHSA-2008-0982.html

Source: cve@mitre.org

Resource:

Broken Link

Hyperlink: http://www.securityfocus.com/archive/1/498431/100/0/threaded

Source: cve@mitre.org

Resource:

Broken Link

Third Party Advisory

VDB Entry

Hyperlink: http://www.securityfocus.com/bid/32232

Source: cve@mitre.org

Resource:

Broken Link

Patch

Third Party Advisory

VDB Entry

Hyperlink: http://www.securitytracker.com/id?1021167

Source: cve@mitre.org

Resource:

Broken Link

Third Party Advisory

VDB Entry

Hyperlink: http://www.ubuntu.com/usn/usn-678-2

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: http://www.vupen.com/english/advisories/2008/3086

Source: cve@mitre.org

Resource:

Broken Link

Hyperlink: http://www.vupen.com/english/advisories/2009/1567

Source: cve@mitre.org

Resource:

Broken Link

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/46482

Source: cve@mitre.org

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://issues.rpath.com/browse/RPL-2886

Source: cve@mitre.org

Resource:

Broken Link

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11650

Source: cve@mitre.org

Resource:

Broken Link

Hyperlink: https://usn.ubuntu.com/678-1/

Source: cve@mitre.org

Resource:

Broken Link

Hyperlink: https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00222.html

Source: cve@mitre.org

Resource:

Mailing List

Hyperlink: https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00293.html

Source: cve@mitre.org

Resource:

Mailing List

Hyperlink: http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3215

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Patch

Hyperlink: http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Hyperlink: http://secunia.com/advisories/32619

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Vendor Advisory

Hyperlink: http://secunia.com/advisories/32681

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://secunia.com/advisories/32687

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://secunia.com/advisories/32879

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://secunia.com/advisories/33501

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://secunia.com/advisories/33694

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://secunia.com/advisories/35423

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://security.gentoo.org/glsa/glsa-200901-10.xml

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: http://sunsolve.sun.com/search/document.do?assetkey=1-26-260528-1

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://wiki.rpath.com/Advisories:rPSA-2008-0322

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://www.debian.org/security/2009/dsa-1719

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Hyperlink: http://www.gnu.org/software/gnutls/security.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Product

Hyperlink: http://www.mandriva.com/security/advisories?name=MDVSA-2008:227

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://www.redhat.com/support/errata/RHSA-2008-0982.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://www.securityfocus.com/archive/1/498431/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Third Party Advisory

VDB Entry

Hyperlink: http://www.securityfocus.com/bid/32232

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Patch

Third Party Advisory

VDB Entry

Hyperlink: http://www.securitytracker.com/id?1021167

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Third Party Advisory

VDB Entry

Hyperlink: http://www.ubuntu.com/usn/usn-678-2

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: http://www.vupen.com/english/advisories/2008/3086

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://www.vupen.com/english/advisories/2009/1567

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/46482

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://issues.rpath.com/browse/RPL-2886

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11650

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: https://usn.ubuntu.com/678-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00222.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Hyperlink: https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00293.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History