Signature Algorithm Mismatch Vulnerability in GnuTLS by GnuTLS
CVE-2015-0282

Currently unrated

Key Information:

Vendor
Gnu
Status
Gnutls
Vendor
CVE Published:
24 March 2015

Summary

The vulnerability in GnuTLS prior to version 3.1.0 involves a failure to ensure that the RSA PKCS #1 signature algorithm corresponds with the signature algorithm specified in the certificate. This oversight enables remote attackers to execute downgrade attacks through various, unspecified vectors, potentially compromising secure communications.

References

http://www.gnutls.org/security.html
x_refsource_CONFIRM
http://www.debian.org/security/2015/dsa-3191
vendor-advisoryx_refsource_DEBIAN
http://www.securityfocus.com/bid/73119
vdb-entryx_refsource_BID

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.