Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 18 Sep 2016 14:31:24 +0200
From: Salvatore Bonaccorso <>
To: OSS Security Mailinglist <>
Subject: CVE Request: GnuTLS: OCSP validation issue (GNUTLS-SA-2016-3)


Some days ago new GnuTLS version were released for GNUTLS-SA-2016-3
(OCSP validation issue):

> Stefan Bühler discovered an issue that affects validation of
> certificates using OCSP responses, which can falsely report a
> certificate as valid under certain circumstances. That issue affects
> gnutls 3.3.24, 3.4.14, 3.5.3 and previous versions. Write-up[0] by
> Stefan Bühler
> Recommendation: Upgrade to GnuTLS versions 3.4.15, 3.5.4 or apply the
> patch referenced in the mail above.

Upstream fix is at [1]. This is as well tracked in Red Hat's bugzilla
at [2].

Could you please assign a CVE for this issue?



Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ