CVE-2008-4989

Publication date 12 November 2008

Last updated 25 August 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

5.9 · Medium

Score breakdown

Description

The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).

Status

Package Ubuntu Release Status
gnutls11 9.10 karmic Not in release
9.04 jaunty Not in release
8.10 intrepid Not in release
8.04 LTS hardy Not in release
7.10 gutsy Not in release
6.06 LTS dapper Ignored end of life
gnutls12 9.10 karmic Not in release
9.04 jaunty Not in release
8.10 intrepid Not in release
8.04 LTS hardy Not in release
7.10 gutsy Not in release
6.06 LTS dapper
Fixed 1.2.9-2ubuntu1.3
gnutls13 9.10 karmic Not in release
9.04 jaunty Not in release
8.10 intrepid Not in release
8.04 LTS hardy
Fixed 2.0.4-1ubuntu2.2
7.10 gutsy
Fixed 1.6.3-1ubuntu0.2
6.06 LTS dapper Not in release
gnutls26 9.10 karmic
Not affected
9.04 jaunty
Not affected
8.10 intrepid
Fixed 2.4.1-1ubuntu0.1
8.04 LTS hardy Not in release
7.10 gutsy Not in release
6.06 LTS dapper Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
gnutls11

Severity score breakdown

Parameter Value
Base score 5.9 · Medium
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact High
Availability impact None
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

Related Ubuntu Security Notices (USN)

    • USN-678-1
    • GnuTLS vulnerability
    • 26 November 2008

Other references