Every CVESearch/Get API key

CVE-2015-0282

GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the...

5.0 MediumFix available

CVE-2015-0282 is a medium vulnerability (CVSS 5.0) in Gnu Gnutls, published June 3, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.40%, the 72nd percentile. Fixed in gnutls26 2.12.23-12ubuntu2.2.

What does this mean?
Severity
5.0 MediumCVSS 2.0, NVD
Exploit chance
1.40%EPSS, 72nd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2.12.23-12ubuntu2.2gnutls26 +23 more

Description

GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors.

Exploit likelihood

1.40%Up 0.2 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gnutls26
Debian:6.0
From an advisory covering 3 CVEs
before 2.8.6-1+squeeze5, plus listed versions
2.8.6-12.8.6-1+squeeze12.8.6-1+squeeze22.8.6-1+squeeze32.8.6-1+squeeze4
2.8.6-1+squeeze5
gnutls26
Debian:7
From an advisory covering 2 CVEs
before 2.12.20-8+deb7u3, plus listed versions
2.12.20-62.12.20-72.12.20-82.12.20-8+deb7u12.12.20-8+deb7u2
2.12.20-8+deb7u3
gnutls-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
gnutls-devel
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
gnutls-guile
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
gnutls
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
gnutls-utils
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
gnutls-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
gnutls-devel
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
gnutls-guile
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
Show 14 moreShow less
Affected packages
PackageAffectedFixed
gnutls
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
gnutls-utils
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
gnutls-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
gnutls-guile
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
gnutls
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
gnutls-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
gnutls-utils
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
gnutls-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
gnutls-guile
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
gnutls
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
gnutls-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
gnutls-utils
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:2.8.5-18.el6
0:2.8.5-18.el6
gnutls26
Ubuntu:14.04:LTS
before 2.12.23-12ubuntu2.2, plus listed versions
2.12.23-1ubuntu42.12.23-1ubuntu52.12.23-12ubuntu12.12.23-12ubuntu22.12.23-12ubuntu2.1
2.12.23-12ubuntu2.2
gnutls26
Ubuntu:14.04:LTS
From an advisory covering 2 CVEs
before 2.12.23-12ubuntu2.2, plus listed versions
2.12.23-1ubuntu42.12.23-1ubuntu52.12.23-12ubuntu12.12.23-12ubuntu22.12.23-12ubuntu2.1
2.12.23-12ubuntu2.2

What each source reports

NVD Score used5.0

GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors.

Record
CVE-2015-0282
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-310
Updated
2026-11-02
CVE ListNo score

GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors.

Record
CVE-2015-0282
Updated
2026-11-02
EUVDEUVD-2015-0295No score

GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors.

Record
EUVD-2015-0295
Updated
2026-11-03
GitHub AdvisoriesGHSA-qx46-76qj-r7r3No score

GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the...

GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors.

Record
GHSA-qx46-76qj-r7r3
Updated
2026-11-02
OSVSUSE-SU-2015:0675-1No score

Security update for gnutls

GnuTLS has been patched to ensure proper parsing of session ids during the TLS/SSL handshake. Additionally, three issues inherited from libtasn1 have been fixed.

Further information is available at http://www.gnutls.org/security.html#GNUTLS-SA-2014-3 http://www.gnutls.org/security.html#GNUTLS-SA-2014-3

These security issues have been fixed:

* Possible memory corruption during connect (CVE-2014-3466)
* Multiple boundary check issues could allow DoS (CVE-2014-3467)
* asn1_get_bit_der() can return negative bit length (CVE-2014-3468)
* Possible DoS by NULL pointer dereference (CVE-2014-3469)

Security Issue references:

* CVE-2014-3466
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3466>
Record
SUSE-SU-2015:0675-1
Updated
2026-11-02
OSVUBUNTU-CVE-2015-0282No score

GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors.

Record
UBUNTU-CVE-2015-0282
Updated
2026-11-02
OSVUSN-2540-1No score

gnutls26, gnutls28 vulnerabilities

It was discovered that GnuTLS did not perform date and time checks on CA certificates, contrary to expectations. This issue only affected Ubuntu 10.04 LTS. (CVE-2014-8155)

Nikos Mavrogiannopoulos discovered that GnuTLS incorrectly verified that signature algorithms matched. A remote attacker could possibly use this issue to downgrade to a disallowed algorithm. This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-0282)

It was discovered that GnuTLS incorrectly verified certificate algorithms. A remote attacker could possibly use this issue to downgrade to a disallowed algorithm. (CVE-2015-0294)

Record
USN-2540-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 36 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open