[SECURITY] [DSA 3177-1] mod-gnutls security update

2015-03-1022:41:35

lists.debian.org

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

5.6 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

48.7%

JSON

Debian Security Advisory DSA-3177-1 [email protected]
http://www.debian.org/security/ Sebastien Delafond
March 10, 2015 http://www.debian.org/security/faq

Package : mod-gnutls
CVE ID : CVE-2015-2091
Debian Bug : 578663

Thomas Klute discovered that in mod-gnutls, an Apache module providing
SSL and TLS encryption with GnuTLS, a bug caused the server's client
verify mode not to be considered at all, in case the directory's
configuration was unset. Clients with invalid certificates were then
able to leverage this flaw in order to get access to that directory.

For the stable distribution (wheezy), this problem has been fixed in
version 0.5.10-1.1+deb7u1.

For the unstable distribution (sid), this problem has been fixed in
version 0.6-1.3.

We recommend that you upgrade your mod-gnutls packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian6i386libapache2-mod-gnutls< 0.5.6-1+squeeze2libapache2-mod-gnutls_0.5.6-1+squeeze2_i386.deb
Debian7s390libapache2-mod-gnutls< 0.5.10-1.1+deb7u1libapache2-mod-gnutls_0.5.10-1.1+deb7u1_s390.deb
Debian7powerpclibapache2-mod-gnutls< 0.5.10-1.1+deb7u1libapache2-mod-gnutls_0.5.10-1.1+deb7u1_powerpc.deb
Debian7s390xlibapache2-mod-gnutls< 0.5.10-1.1+deb7u1libapache2-mod-gnutls_0.5.10-1.1+deb7u1_s390x.deb
Debian7kfreebsd-amd64libapache2-mod-gnutls< 0.5.10-1.1+deb7u1libapache2-mod-gnutls_0.5.10-1.1+deb7u1_kfreebsd-amd64.deb
Debian7mipsellibapache2-mod-gnutls< 0.5.10-1.1+deb7u1libapache2-mod-gnutls_0.5.10-1.1+deb7u1_mipsel.deb
Debian7mipslibapache2-mod-gnutls< 0.5.10-1.1+deb7u1libapache2-mod-gnutls_0.5.10-1.1+deb7u1_mips.deb
Debian7armhflibapache2-mod-gnutls< 0.5.10-1.1+deb7u1libapache2-mod-gnutls_0.5.10-1.1+deb7u1_armhf.deb
Debian6amd64libapache2-mod-gnutls< 0.5.6-1+squeeze2libapache2-mod-gnutls_0.5.6-1+squeeze2_amd64.deb
Debian7i386libapache2-mod-gnutls< 0.5.10-1.1+deb7u1libapache2-mod-gnutls_0.5.10-1.1+deb7u1_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	i386	libapache2-mod-gnutls	< 0.5.6-1+squeeze2	libapache2-mod-gnutls_0.5.6-1+squeeze2_i386.deb
Debian	7	s390	libapache2-mod-gnutls	< 0.5.10-1.1+deb7u1	libapache2-mod-gnutls_0.5.10-1.1+deb7u1_s390.deb
Debian	7	powerpc	libapache2-mod-gnutls	< 0.5.10-1.1+deb7u1	libapache2-mod-gnutls_0.5.10-1.1+deb7u1_powerpc.deb
Debian	7	s390x	libapache2-mod-gnutls	< 0.5.10-1.1+deb7u1	libapache2-mod-gnutls_0.5.10-1.1+deb7u1_s390x.deb
Debian	7	kfreebsd-amd64	libapache2-mod-gnutls	< 0.5.10-1.1+deb7u1	libapache2-mod-gnutls_0.5.10-1.1+deb7u1_kfreebsd-amd64.deb
Debian	7	mipsel	libapache2-mod-gnutls	< 0.5.10-1.1+deb7u1	libapache2-mod-gnutls_0.5.10-1.1+deb7u1_mipsel.deb
Debian	7	mips	libapache2-mod-gnutls	< 0.5.10-1.1+deb7u1	libapache2-mod-gnutls_0.5.10-1.1+deb7u1_mips.deb
Debian	7	armhf	libapache2-mod-gnutls	< 0.5.10-1.1+deb7u1	libapache2-mod-gnutls_0.5.10-1.1+deb7u1_armhf.deb
Debian	6	amd64	libapache2-mod-gnutls	< 0.5.6-1+squeeze2	libapache2-mod-gnutls_0.5.6-1+squeeze2_amd64.deb
Debian	7	i386	libapache2-mod-gnutls	< 0.5.10-1.1+deb7u1	libapache2-mod-gnutls_0.5.10-1.1+deb7u1_i386.deb