[SECURITY] [DLA 170-1] mod-gnutls security update

2015-03-1416:35:48

lists.debian.org

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

6.1 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

48.7%

JSON

Package : mod-gnutls
Version : 0.5.6-1+squeeze2
CVE ID : CVE-2015-2091
Debian Bug : 578663

Thomas Klute discovered that in mod-gnutls, an Apache module providing
SSL and TLS encryption with GnuTLS, a bug caused the server's client
verify mode not to be considered at all, in case the directory's
configuration was unset. Clients with invalid certificates were then
able to leverage this flaw in order to get access to that directory.

OSVersionArchitecturePackageVersionFilename
Debian6amd64libapache2-mod-gnutls< 0.5.6-1+squeeze2libapache2-mod-gnutls_0.5.6-1+squeeze2_amd64.deb
Debian7sparclibapache2-mod-gnutls< 0.5.10-1.1+deb7u1libapache2-mod-gnutls_0.5.10-1.1+deb7u1_sparc.deb
Debian7mipsellibapache2-mod-gnutls< 0.5.10-1.1+deb7u1libapache2-mod-gnutls_0.5.10-1.1+deb7u1_mipsel.deb
Debian7i386libapache2-mod-gnutls< 0.5.10-1.1+deb7u1libapache2-mod-gnutls_0.5.10-1.1+deb7u1_i386.deb
Debian6allmod-gnutls< 0.5.6-1+squeeze2mod-gnutls_0.5.6-1+squeeze2_all.deb
Debian7mipslibapache2-mod-gnutls< 0.5.10-1.1+deb7u1libapache2-mod-gnutls_0.5.10-1.1+deb7u1_mips.deb
Debian7kfreebsd-i386libapache2-mod-gnutls< 0.5.10-1.1+deb7u1libapache2-mod-gnutls_0.5.10-1.1+deb7u1_kfreebsd-i386.deb
Debian7s390xlibapache2-mod-gnutls< 0.5.10-1.1+deb7u1libapache2-mod-gnutls_0.5.10-1.1+deb7u1_s390x.deb
Debian7armellibapache2-mod-gnutls< 0.5.10-1.1+deb7u1libapache2-mod-gnutls_0.5.10-1.1+deb7u1_armel.deb
Debian7s390libapache2-mod-gnutls< 0.5.10-1.1+deb7u1libapache2-mod-gnutls_0.5.10-1.1+deb7u1_s390.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	amd64	libapache2-mod-gnutls	< 0.5.6-1+squeeze2	libapache2-mod-gnutls_0.5.6-1+squeeze2_amd64.deb
Debian	7	sparc	libapache2-mod-gnutls	< 0.5.10-1.1+deb7u1	libapache2-mod-gnutls_0.5.10-1.1+deb7u1_sparc.deb
Debian	7	mipsel	libapache2-mod-gnutls	< 0.5.10-1.1+deb7u1	libapache2-mod-gnutls_0.5.10-1.1+deb7u1_mipsel.deb
Debian	7	i386	libapache2-mod-gnutls	< 0.5.10-1.1+deb7u1	libapache2-mod-gnutls_0.5.10-1.1+deb7u1_i386.deb
Debian	6	all	mod-gnutls	< 0.5.6-1+squeeze2	mod-gnutls_0.5.6-1+squeeze2_all.deb
Debian	7	mips	libapache2-mod-gnutls	< 0.5.10-1.1+deb7u1	libapache2-mod-gnutls_0.5.10-1.1+deb7u1_mips.deb
Debian	7	kfreebsd-i386	libapache2-mod-gnutls	< 0.5.10-1.1+deb7u1	libapache2-mod-gnutls_0.5.10-1.1+deb7u1_kfreebsd-i386.deb
Debian	7	s390x	libapache2-mod-gnutls	< 0.5.10-1.1+deb7u1	libapache2-mod-gnutls_0.5.10-1.1+deb7u1_s390x.deb
Debian	7	armel	libapache2-mod-gnutls	< 0.5.10-1.1+deb7u1	libapache2-mod-gnutls_0.5.10-1.1+deb7u1_armel.deb
Debian	7	s390	libapache2-mod-gnutls	< 0.5.10-1.1+deb7u1	libapache2-mod-gnutls_0.5.10-1.1+deb7u1_s390.deb