{"id":"CVE-2008-4989","aliases":["DEBIAN-CVE-2008-4989","DSA-1719-1","EUVD-2008-4968","GHSA-8ph9-x262-cchw","RHSA-2008:0982","openSUSE-SU-2024:10105-1"],"status":"published","title":"The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2...","description":"The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01882,"percentile":0.79612,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2008-11-13T00:00:00Z","modified":"2026-06-26T12:18:36Z","fixes":[{"ecosystem":"Debian:4.0","package":"gnutls13","fixed_in":["1.4.4-3+etch3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"gnutls","fixed_in":["0:1.4.1-3.el5_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"gnutls-debuginfo","fixed_in":["0:1.4.1-3.el5_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"gnutls-devel","fixed_in":["0:1.4.1-3.el5_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnutls","fixed_in":["0:1.4.1-3.el5_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnutls-debuginfo","fixed_in":["0:1.4.1-3.el5_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnutls-utils","fixed_in":["0:1.4.1-3.el5_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls","fixed_in":["0:1.4.1-3.el5_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-debuginfo","fixed_in":["0:1.4.1-3.el5_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-devel","fixed_in":["0:1.4.1-3.el5_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-utils","fixed_in":["0:1.4.1-3.el5_2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:4.0","package":"gnutls13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-3+etch3"}]}],"versions":["1.4.4-3","1.4.4-3+etch1","1.4.4-3+etch2"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-3.el5_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-3.el5_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-3.el5_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-3.el5_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-3.el5_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-3.el5_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-3.el5_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-3.el5_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-3.el5_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-3.el5_2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.15-1.1"}]}],"bundled":10}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnu","product":"gnutls"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"suse","product":"linux_enterprise"},{"vendor":"suse","product":"linux_enterprise_server"}],"references":[{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:227","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Broken Link"]},{"url":"http://www.ubuntu.com/usn/usn-678-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory"]},{"url":"http://secunia.com/advisories/33694","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"http://security.gentoo.org/glsa/glsa-200901-10.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0982.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link"]},{"url":"https://usn.ubuntu.com/678-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Broken Link"]},{"url":"http://www.securityfocus.com/archive/1/498431/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3215","tags":["mailing-list","x_refsource_MLIST","x_transferred","Broken Link","Patch"]},{"url":"http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217","tags":["mailing-list","x_refsource_MLIST","x_transferred","Broken Link"]},{"url":"http://wiki.rpath.com/Advisories:rPSA-2008-0322","tags":["x_refsource_CONFIRM","x_transferred","Broken Link"]},{"url":"http://secunia.com/advisories/32687","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00293.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List"]},{"url":"http://www.gnu.org/software/gnutls/security.html","tags":["x_refsource_CONFIRM","x_transferred","Product"]},{"url":"https://issues.rpath.com/browse/RPL-2886","tags":["x_refsource_CONFIRM","x_transferred","Broken Link"]},{"url":"http://secunia.com/advisories/35423","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List"]},{"url":"http://www.securityfocus.com/bid/32232","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Patch","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1021167","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-260528-1","tags":["vendor-advisory","x_refsource_SUNALERT","x_transferred","Broken Link"]},{"url":"http://secunia.com/advisories/33501","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"http://secunia.com/advisories/32879","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"http://www.vupen.com/english/advisories/2009/1567","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Broken Link"]},{"url":"http://secunia.com/advisories/32619","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2008/3086","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Broken Link"]},{"url":"http://secunia.com/advisories/32681","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11650","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","Broken Link"]},{"url":"http://www.debian.org/security/2009/dsa-1719","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Mailing List"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00222.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46482","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-4989","tags":["advisory"]},{"url":"https://usn.ubuntu.com/678-1"},{"url":"https://github.com/advisories/GHSA-8ph9-x262-cchw"},{"url":"https://access.redhat.com/errata/RHSA-2008:0982","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=470079","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0982.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-4989","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-4989","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6251","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2008-4989","description":"The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).","status":"published","published":"2008-11-13T00:00:00Z","modified":"2024-08-07T10:31:28.318Z","updated_at":"2026-11-02T14:34:46.587139Z"}],"euvd":[{"id":"EUVD-2008-4968","description":"The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).","status":"published","published":"2008-11-13T00:00:00Z","modified":"2024-08-07T10:31:28Z","updated_at":"2026-11-03T01:38:45.484352Z"}],"ghsa":[{"id":"GHSA-8ph9-x262-cchw","title":"The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2...","description":"The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).","status":"published","published":"2022-05-14T02:41:02Z","modified":"2026-03-15T05:01:31Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:06:38.115187Z"}],"nvd":[{"id":"CVE-2008-4989","description":"The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).","status":"published","published":"2008-11-13T01:00:01.177Z","modified":"2026-06-16T22:58:53.89Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:01:29.702694Z"}],"osv":[{"id":"DSA-1719-1","title":"gnutls13 - certificate validation","status":"published","published":"2009-02-10T00:00:00Z","modified":"2026-03-09T01:19:17.442022Z","updated_at":"2026-11-02T15:46:14.734124Z"},{"id":"openSUSE-SU-2024:10105-1","title":"gnutls-3.4.15-1.1 on GA media","description":"These are all security issues fixed in the gnutls-3.4.15-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:28.673202Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2008:0982","title":"Red Hat Security Advisory: gnutls security update","status":"published","published":"2024-09-15T17:37:05Z","modified":"2026-06-26T12:18:36.916742563Z","updated_at":"2026-11-02T15:53:00.468834Z"}]}}