Every CVE Search/ Get API key

CVE-2014-0092

lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle...

5.8 MediumFix available

lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

Exploit likelihood

29.9%Up 27.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.8

lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

Record
CVE-2014-0092
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness
CWE-310
Updated
2026-11-02
CVE List No score

lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

Record
CVE-2014-0092
Updated
2026-11-02
EUVDEUVD-2014-0177 No score

lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

Record
EUVD-2014-0177
Updated
2026-11-03
GitHub AdvisoriesGHSA-c9fv-cm23-r7xv No score

lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle...

lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

Record
GHSA-c9fv-cm23-r7xv
Updated
2026-11-02
OSV No score

lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

Record
CVE-2014-0092
Updated
2026-11-02
OSVDEBIAN-CVE-2014-0092 No score

lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

Record
DEBIAN-CVE-2014-0092
Updated
2026-11-02
Show 4 moreShow less
OSVMGASA-2014-0117 No score

Updated gnutls packages fix security vulnerability

It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a specially crafted certificate that could be accepted by GnuTLS as valid for a site chosen by the attacker (CVE-2014-0092).

Record
MGASA-2014-0117
Updated
2026-11-02
OSVopenSUSE-SU-2024:10105-1 No score

gnutls-3.4.15-1.1 on GA media

These are all security issues fixed in the gnutls-3.4.15-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10105-1
Updated
2026-11-02
OSVSUSE-SU-2015:0675-1 No score

Security update for gnutls

GnuTLS has been patched to ensure proper parsing of session ids during the TLS/SSL handshake. Additionally, three issues inherited from libtasn1 have been fixed.

Further information is available at http://www.gnutls.org/security.html#GNUTLS-SA-2014-3 http://www.gnutls.org/security.html#GNUTLS-SA-2014-3

These security issues have been fixed:

* Possible memory corruption during connect (CVE-2014-3466)
* Multiple boundary check issues could allow DoS (CVE-2014-3467)
* asn1_get_bit_der() can return negative bit length (CVE-2014-3468)
* Possible DoS by NULL pointer dereference (CVE-2014-3469)

Security Issue references:

* CVE-2014-3466
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3466>
Record
SUSE-SU-2015:0675-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-0092 No score

lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

Record
UBUNTU-CVE-2014-0092
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gnutls28
Debian:12
 before 3.2.11-2
3.2.11-2
gnutls28
Debian:13
 before 3.2.11-2
3.2.11-2
gnutls28
Debian:14
 before 3.2.11-2
3.2.11-2
gnutls26
Debian:6.0
 before 2.8.6-1+squeeze3, plus listed versions
2.8.6-12.8.6-1+squeeze12.8.6-1+squeeze2
2.8.6-1+squeeze3
gnutls26
Debian:7
 before 2.12.20-8+deb7u1, plus listed versions
2.12.20-62.12.20-72.12.20-8
2.12.20-8+deb7u1
gnutls
Mageia:3
 before 3.1.16-1.2.mga3
3.1.16-1.2.mga3
gnutls
Mageia:4
 before 3.2.7-1.2.mga4
3.2.7-1.2.mga4
gnutls
Red Hat:enterprise_linux:6::client
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
gnutls-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
gnutls-utils
Red Hat:enterprise_linux:6::client
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
Show 73 moreShow less
Affected packages
PackageAffectedFixed
gnutls-devel
Red Hat:enterprise_linux:6::client
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
gnutls-guile
Red Hat:enterprise_linux:6::client
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
gnutls
Red Hat:enterprise_linux:6::computenode
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
gnutls-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
gnutls-utils
Red Hat:enterprise_linux:6::computenode
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
gnutls-devel
Red Hat:enterprise_linux:6::computenode
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
gnutls-guile
Red Hat:enterprise_linux:6::computenode
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
gnutls
Red Hat:enterprise_linux:6::server
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
gnutls-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
gnutls-devel
Red Hat:enterprise_linux:6::server
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
gnutls-utils
Red Hat:enterprise_linux:6::server
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
gnutls-guile
Red Hat:enterprise_linux:6::server
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
gnutls
Red Hat:enterprise_linux:6::workstation
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
gnutls-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
gnutls-devel
Red Hat:enterprise_linux:6::workstation
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
gnutls-utils
Red Hat:enterprise_linux:6::workstation
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
gnutls-guile
Red Hat:enterprise_linux:6::workstation
 before 0:2.8.5-13.el6_5
0:2.8.5-13.el6_5
gnutls
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:1.4.1-14.el5_10
0:1.4.1-14.el5_10
gnutls-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:1.4.1-14.el5_10
0:1.4.1-14.el5_10
gnutls-utils
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:1.4.1-14.el5_10
0:1.4.1-14.el5_10
gnutls
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 2 CVEs
 before 0:1.4.1-14.el5_10
0:1.4.1-14.el5_10
gnutls-debuginfo
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 2 CVEs
 before 0:1.4.1-14.el5_10
0:1.4.1-14.el5_10
gnutls-devel
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 2 CVEs
 before 0:1.4.1-14.el5_10
0:1.4.1-14.el5_10
gnutls
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:1.4.1-14.el5_10
0:1.4.1-14.el5_10
gnutls-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:1.4.1-14.el5_10
0:1.4.1-14.el5_10
gnutls-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:1.4.1-14.el5_10
0:1.4.1-14.el5_10
gnutls-utils
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:1.4.1-14.el5_10
0:1.4.1-14.el5_10
gnutls
Red Hat:rhel_els:4::as
 before 0:1.0.20-5.el4
0:1.0.20-5.el4
gnutls-debuginfo
Red Hat:rhel_els:4::as
 before 0:1.0.20-5.el4
0:1.0.20-5.el4
gnutls-devel
Red Hat:rhel_els:4::as
 before 0:1.0.20-5.el4
0:1.0.20-5.el4
gnutls
Red Hat:rhel_els:4::es
 before 0:1.0.20-5.el4
0:1.0.20-5.el4
gnutls-debuginfo
Red Hat:rhel_els:4::es
 before 0:1.0.20-5.el4
0:1.0.20-5.el4
gnutls-devel
Red Hat:rhel_els:4::es
 before 0:1.0.20-5.el4
0:1.0.20-5.el4
gnutls
Red Hat:rhel_mission_critical:5.3
 before 0:1.4.1-3.el5_3.6
0:1.4.1-3.el5_3.6
gnutls-debuginfo
Red Hat:rhel_mission_critical:5.3
 before 0:1.4.1-3.el5_3.6
0:1.4.1-3.el5_3.6
gnutls-devel
Red Hat:rhel_mission_critical:5.3
 before 0:1.4.1-3.el5_3.6
0:1.4.1-3.el5_3.6
gnutls-utils
Red Hat:rhel_mission_critical:5.3
 before 0:1.4.1-3.el5_3.6
0:1.4.1-3.el5_3.6
gnutls
Red Hat:rhel_mission_critical:5.6
 before 0:1.4.1-7.el5_6.1
0:1.4.1-7.el5_6.1
gnutls-debuginfo
Red Hat:rhel_mission_critical:5.6
 before 0:1.4.1-7.el5_6.1
0:1.4.1-7.el5_6.1
gnutls-devel
Red Hat:rhel_mission_critical:5.6
 before 0:1.4.1-7.el5_6.1
0:1.4.1-7.el5_6.1
gnutls-utils
Red Hat:rhel_mission_critical:5.6
 before 0:1.4.1-7.el5_6.1
0:1.4.1-7.el5_6.1
gnutls
Red Hat:rhel_eus:5.9
 before 0:1.4.1-10.el5_9.3
0:1.4.1-10.el5_9.3
gnutls-debuginfo
Red Hat:rhel_eus:5.9
 before 0:1.4.1-10.el5_9.3
0:1.4.1-10.el5_9.3
gnutls-devel
Red Hat:rhel_eus:5.9
 before 0:1.4.1-10.el5_9.3
0:1.4.1-10.el5_9.3
gnutls-utils
Red Hat:rhel_eus:5.9
 before 0:1.4.1-10.el5_9.3
0:1.4.1-10.el5_9.3
gnutls
Red Hat:rhel_eus:6.3::computenode
 before 0:2.8.5-7.el6_3.2
0:2.8.5-7.el6_3.2
gnutls-debuginfo
Red Hat:rhel_eus:6.3::computenode
 before 0:2.8.5-7.el6_3.2
0:2.8.5-7.el6_3.2
gnutls-utils
Red Hat:rhel_eus:6.3::computenode
 before 0:2.8.5-7.el6_3.2
0:2.8.5-7.el6_3.2
gnutls
Red Hat:rhel_eus:6.4::computenode
 before 0:2.8.5-10.el6_4.3
0:2.8.5-10.el6_4.3
gnutls-debuginfo
Red Hat:rhel_eus:6.4::computenode
 before 0:2.8.5-10.el6_4.3
0:2.8.5-10.el6_4.3
gnutls-utils
Red Hat:rhel_eus:6.4::computenode
 before 0:2.8.5-10.el6_4.3
0:2.8.5-10.el6_4.3
gnutls-devel
Red Hat:rhel_eus:6.3::computenode
 before 0:2.8.5-7.el6_3.2
0:2.8.5-7.el6_3.2
gnutls-guile
Red Hat:rhel_eus:6.3::computenode
 before 0:2.8.5-7.el6_3.2
0:2.8.5-7.el6_3.2
gnutls-devel
Red Hat:rhel_eus:6.4::computenode
 before 0:2.8.5-10.el6_4.3
0:2.8.5-10.el6_4.3
gnutls-guile
Red Hat:rhel_eus:6.4::computenode
 before 0:2.8.5-10.el6_4.3
0:2.8.5-10.el6_4.3
gnutls
Red Hat:rhel_mission_critical:6.2::server
 before 0:2.8.5-4.el6_2.3
0:2.8.5-4.el6_2.3
gnutls-debuginfo
Red Hat:rhel_mission_critical:6.2::server
 before 0:2.8.5-4.el6_2.3
0:2.8.5-4.el6_2.3
gnutls-devel
Red Hat:rhel_mission_critical:6.2::server
 before 0:2.8.5-4.el6_2.3
0:2.8.5-4.el6_2.3
gnutls-utils
Red Hat:rhel_mission_critical:6.2::server
 before 0:2.8.5-4.el6_2.3
0:2.8.5-4.el6_2.3
gnutls
Red Hat:rhel_eus:6.3::server
 before 0:2.8.5-7.el6_3.2
0:2.8.5-7.el6_3.2
gnutls-debuginfo
Red Hat:rhel_eus:6.3::server
 before 0:2.8.5-7.el6_3.2
0:2.8.5-7.el6_3.2
gnutls-devel
Red Hat:rhel_eus:6.3::server
 before 0:2.8.5-7.el6_3.2
0:2.8.5-7.el6_3.2
gnutls-utils
Red Hat:rhel_eus:6.3::server
 before 0:2.8.5-7.el6_3.2
0:2.8.5-7.el6_3.2
gnutls
Red Hat:rhel_eus:6.4::server
 before 0:2.8.5-10.el6_4.3
0:2.8.5-10.el6_4.3
gnutls-debuginfo
Red Hat:rhel_eus:6.4::server
 before 0:2.8.5-10.el6_4.3
0:2.8.5-10.el6_4.3
gnutls-devel
Red Hat:rhel_eus:6.4::server
 before 0:2.8.5-10.el6_4.3
0:2.8.5-10.el6_4.3
gnutls-utils
Red Hat:rhel_eus:6.4::server
 before 0:2.8.5-10.el6_4.3
0:2.8.5-10.el6_4.3
gnutls-guile
Red Hat:rhel_mission_critical:6.2::server
 before 0:2.8.5-4.el6_2.3
0:2.8.5-4.el6_2.3
gnutls-guile
Red Hat:rhel_eus:6.3::server
 before 0:2.8.5-7.el6_3.2
0:2.8.5-7.el6_3.2
gnutls-guile
Red Hat:rhel_eus:6.4::server
 before 0:2.8.5-10.el6_4.3
0:2.8.5-10.el6_4.3
rhev-hypervisor6
Red Hat:enterprise_linux:6::hypervisor
From an advisory covering 3 CVEs
 before 0:6.5-20140324.0.el6ev
0:6.5-20140324.0.el6ev
gnutls26
Ubuntu:14.04:LTS
 before 2.12.23-12ubuntu2, plus listed versions
2.12.23-1ubuntu42.12.23-1ubuntu52.12.23-12ubuntu1
2.12.23-12ubuntu2
gnutls
openSUSE:Tumbleweed
From an advisory covering 10 CVEs
 before 3.4.15-1.1
3.4.15-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0092 is a medium vulnerability (CVSS 5.8) in Gnu Gnutls, published March 3, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 29.9%, the 98th percentile. Fixed in gnutls28 3.2.11-2.

References

Show 76 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open