CVE-2025-32989

A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly.

A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly.

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.

Security Fix(es):

A vulnerability, which was classified as critical, was found in GnuTLS (Network Encryption Software) (affected version unknown).CWE is classifying the issue as CWE-415. The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.This is going to have an impact on confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-32988)

GnuTLS is a free secure communication library for implementing SSL, TLS and DTLS protocols open source. GnuTLS has a trust management vulnerability, which originated from improper processing of CT SCT SCT expansion during X.509 certificate resolution, which may lead to information leakage.(CVE-2025-32989)

GnuTLS is a free secure communication library for implementing SSL, TLS and DTLS protocols. There is a security vulnerability in GnuTLS that originates from a heap buffer overflow in the certtool tool template parsing logic, which can lead to memory corruption and denial of service.(CVE-2025-32990)

A vulnerability, which was classified as problematic, was found in GnuTLS (Network Encryption Software) (affected version unknown).CWE is classifying the issue as CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.This is going to have an impact on availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-21000).(CVE-2025-6395)

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.

Security Fix(es):

A vulnerability, which was classified as critical, was found in GnuTLS (Network Encryption Software) (affected version unknown).CWE is classifying the issue as CWE-415. The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.This is going to have an impact on confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-32988)

GnuTLS is a free secure communication library for implementing SSL, TLS and DTLS protocols open source. GnuTLS has a trust management vulnerability, which originated from improper processing of CT SCT SCT expansion during X.509 certificate resolution, which may lead to information leakage.(CVE-2025-32989)

GnuTLS is a free secure communication library for implementing SSL, TLS and DTLS protocols. There is a security vulnerability in GnuTLS that originates from a heap buffer overflow in the certtool tool template parsing logic, which can lead to memory corruption and denial of service.(CVE-2025-32990)

A vulnerability, which was classified as problematic, was found in GnuTLS (Network Encryption Software) (affected version unknown).CWE is classifying the issue as CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.This is going to have an impact on availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-21000).(CVE-2025-6395)

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.

Security Fix(es):

A vulnerability, which was classified as critical, was found in GnuTLS (Network Encryption Software) (affected version unknown).CWE is classifying the issue as CWE-415. The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.This is going to have an impact on confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-32988)

GnuTLS is a free secure communication library for implementing SSL, TLS and DTLS protocols open source. GnuTLS has a trust management vulnerability, which originated from improper processing of CT SCT SCT expansion during X.509 certificate resolution, which may lead to information leakage.(CVE-2025-32989)

GnuTLS is a free secure communication library for implementing SSL, TLS and DTLS protocols. There is a security vulnerability in GnuTLS that originates from a heap buffer overflow in the certtool tool template parsing logic, which can lead to memory corruption and denial of service.(CVE-2025-32990)

A vulnerability, which was classified as problematic, was found in GnuTLS (Network Encryption Software) (affected version unknown).CWE is classifying the issue as CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.This is going to have an impact on availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-21000).(CVE-2025-6395)

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

• gnutls: Vulnerability in GnuTLS certtool template parsing (CVE-2025-32990)

• gnutls: Vulnerability in GnuTLS SCT extension parsing (CVE-2025-32989)

• gnutls: Vulnerability in GnuTLS otherName SAN export (CVE-2025-32988)

• gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite() (CVE-2025-6395)

Bug Fix(es) and Enhancement(s):

• gnutls: Vulnerability in GnuTLS certtool template parsing (BZ#2359620)

• gnutls: Vulnerability in GnuTLS SCT extension parsing (BZ#2359621)

• gnutls: Vulnerability in GnuTLS otherName SAN export (BZ#2359622)

• gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite() (BZ#2376755)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

• gnutls: Vulnerability in GnuTLS certtool template parsing (CVE-2025-32990)

• gnutls: Vulnerability in GnuTLS SCT extension parsing (CVE-2025-32989)

• gnutls: Vulnerability in GnuTLS otherName SAN export (CVE-2025-32988)

• gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite() (CVE-2025-6395)

Bug Fix(es) and Enhancement(s):

• gnutls: Vulnerability in GnuTLS certtool template parsing (BZ#2359620)

• gnutls: Vulnerability in GnuTLS SCT extension parsing (BZ#2359621)

• gnutls: Vulnerability in GnuTLS otherName SAN export (BZ#2359622)

• gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite() (BZ#2376755)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly.

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

• gnutls: Vulnerability in GnuTLS certtool template parsing (CVE-2025-32990)
• gnutls: Vulnerability in GnuTLS SCT extension parsing (CVE-2025-32989)
• gnutls: Vulnerability in GnuTLS otherName SAN export (CVE-2025-32988)
• gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite() (CVE-2025-6395)

Bug Fix(es) and Enhancement(s):

• gnutls: Vulnerability in GnuTLS certtool template parsing (BZ#2359620)
• gnutls: Vulnerability in GnuTLS SCT extension parsing (BZ#2359621)
• gnutls: Vulnerability in GnuTLS otherName SAN export (BZ#2359622)
• gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite() (BZ#2376755)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

• gnutls: Vulnerability in GnuTLS certtool template parsing (CVE-2025-32990)
• gnutls: Vulnerability in GnuTLS SCT extension parsing (CVE-2025-32989)
• gnutls: Vulnerability in GnuTLS otherName SAN export (CVE-2025-32988)
• gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite() (CVE-2025-6395)

Bug Fix(es) and Enhancement(s):

• gnutls: Vulnerability in GnuTLS certtool template parsing (BZ#2359620)
• gnutls: Vulnerability in GnuTLS SCT extension parsing (BZ#2359621)
• gnutls: Vulnerability in GnuTLS otherName SAN export (BZ#2359622)
• gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite() (BZ#2376755)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly.

A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly.

• CVE-2025-32989: fix read buffer overrun in x509 SCT timestamps

null pointer dereference in _gnutls_figure_common_ciphersuite(). (CVE-2025-6395) Vulnerability in gnutls othername san export. (CVE-2025-32988) Vulnerability in gnutls sct extension parsing. (CVE-2025-32989) Vulnerability in gnutls certtool template parsing. (CVE-2025-32990)

These are all security issues fixed in the gnutls-3.8.10-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2025-32989 in the rootio-gnutls package for Root:Alpine:3.22. Multiple fixed versions available.

This update for gnutls fixes the following issues:

• CVE-2025-6395: Fix NULL pointer dereference when 2nd Client Hello omits PSK (bsc#1246299)
• CVE-2025-32988: Fix double-free due to incorrect ownership handling in the export logic of SAN entries containing an otherName (bsc#1246232)
• CVE-2025-32989: Fix heap buffer overread when handling the CT SCT extension during X.509 certificate parsing (bsc#1246233)
• CVE-2025-32990: Fix 1-byte heap buffer overflow when parsing templates with certtool (bsc#1246267)

This update for gnutls fixes the following issues:

• CVE-2025-6395: Fix NULL pointer dereference when 2nd Client Hello omits PSK (bsc#1246299)
• CVE-2025-32988: Fix double-free due to incorrect ownership handling in the export logic of SAN entries containing an otherName (bsc#1246232)
• CVE-2025-32989: Fix heap buffer overread when handling the CT SCT extension during X.509 certificate parsing (bsc#1246233)
• CVE-2025-32990: Fix 1-byte heap buffer overflow when parsing templates with certtool (bsc#1246267)

This update for gnutls fixes the following issues:

• CVE-2025-6395: Fix NULL pointer dereference when 2nd Client Hello omits PSK (bsc#1246299)
• CVE-2025-32988: Fix double-free due to incorrect ownership handling in the export logic of SAN entries containing an otherName (bsc#1246232)
• CVE-2025-32989: Fix heap buffer overread when handling the CT SCT extension during X.509 certificate parsing (bsc#1246233)
• CVE-2025-32990: Fix 1-byte heap buffer overflow when parsing templates with certtool (bsc#1246267)

This update for gnutls fixes the following issues:

• CVE-2025-32988: Fixed double-free due to incorrect ownership handling (bsc#1246232)
• CVE-2025-32989: Fixed heap buffer overread during X.509 certificate parsing (bsc#1246233)
• CVE-2025-32990: Fixed 1-byte heap buffer overflow when parsing templates with certtool (bsc#1246267)
• CVE-2025-6395: Fixed NULL pointer dereference when 2nd Client Hello omits PSK (bsc#1246299)

This update for gnutls fixes the following issues:

• CVE-2025-32988: Fixed double-free due to incorrect ownership handling in the export logic of SAN entries containing an otherName (bsc#1246232).
• CVE-2025-32989: Fixed heap buffer overread when handling the CT SCT extension during X.509 certificate parsing (bsc#1246233).
• CVE-2025-32990: Fixed 1-byte heap buffer overflow when parsing templates with certtool (bsc#1246267).
• CVE-2025-6395: Fixed NULL pointer dereference when 2nd Client Hello omits PSK (bsc#1246299).

It was discovered that GnuTLS incorrectly handled exporting Subject Alternative Name (SAN) entries containing an otherName. A remote attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-32988)

It was discovered that GnuTLS incorrectly handled parsing the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension. A remote attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2025-32989)

It was discovered that the GnuTLS certtool utility incorrectly handled parsing certain template files. An attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-32990)

Stefan Bühler discovered that GnuTLS incorrectly handled parsing certain template files. An attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service. (CVE-2025-6395)