{"id":"CVE-2015-0294","aliases":["DEBIAN-CVE-2015-0294","DLA-180-1","DSA-3191-1","EUVD-2015-0307","GHSA-xqm3-jfj9-8pf2","MGASA-2015-0322","RHSA-2015:1457","SUSE-SU-2015:0675-1","SUSE-SU-2015:0735-1","UBUNTU-CVE-2015-0294","USN-2540-1"],"status":"published","title":"GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a...","description":"GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01586,"percentile":0.75745,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2014-06-03T20:02:07Z","modified":"2026-09-09T07:00:05Z","fixes":[{"ecosystem":"Debian:12","package":"gnutls28","fixed_in":["3.3.8-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnutls28","fixed_in":["3.3.8-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnutls28","fixed_in":["3.3.8-6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"gnutls","fixed_in":["3.2.15-7.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"gnutls","fixed_in":["3.2.15-7.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12","package":"gnutls","fixed_in":["3.2.15-7.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"gnutls","fixed_in":["3.2.15-7.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"gnutls26","fixed_in":["2.12.23-12ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-6"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"gnutls26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.6-1+squeeze5"}]}],"versions":["2.8.6-1","2.8.6-1+squeeze1","2.8.6-1+squeeze2","2.8.6-1+squeeze3","2.8.6-1+squeeze4"],"bundled":3},{"source":"osv","ecosystem":"Debian:7","package":"gnutls26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.20-8+deb7u3"}]}],"versions":["2.12.20-6","2.12.20-7","2.12.20-8","2.12.20-8+deb7u1","2.12.20-8+deb7u2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1.7.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.21-1.1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-guile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-guile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-guile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-guile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-7.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-7.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-7.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-7.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"gnutls26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.23-12ubuntu2.2"}]}],"versions":["2.12.23-1ubuntu4","2.12.23-1ubuntu5","2.12.23-12ubuntu1","2.12.23-12ubuntu2","2.12.23-12ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"gnutls26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.23-12ubuntu2.2"}]}],"versions":["2.12.23-1ubuntu4","2.12.23-1ubuntu5","2.12.23-12ubuntu1","2.12.23-12ubuntu2","2.12.23-12ubuntu2.1"],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"gnu","product":"gnutls"},{"vendor":"gnutls","product":"gnutls"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1196323","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"https://gitlab.com/gnutls/gnutls/commit/6e76e9b9fa845b76b0b9a45f05f4b54a052578ff","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"http://www.debian.org/security/2015/dsa-3191","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-0294","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xqm3-jfj9-8pf2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-0294","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0322.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15504","tags":["report"]},{"url":"https://www.debian.org/security/2015/dsa-3191","tags":["web"]},{"url":"https://www.debian.org/security/2015/dsa-3334","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1457","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1036385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1194371","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1197995","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1457.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-8155","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8155","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8155","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-0282","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-0282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-0282","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-0294","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-0294","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150675-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/821818","tags":["report"]},{"url":"https://bugzilla.suse.com/835760","tags":["report"]},{"url":"https://bugzilla.suse.com/865804","tags":["report"]},{"url":"https://bugzilla.suse.com/865993","tags":["report"]},{"url":"https://bugzilla.suse.com/880730","tags":["report"]},{"url":"https://bugzilla.suse.com/880910","tags":["report"]},{"url":"https://bugzilla.suse.com/919938","tags":["report"]},{"url":"https://bugzilla.suse.com/921684","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2009-5138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0294","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150735-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-0294","tags":["report"]},{"url":"http://lists.gnutls.org/pipermail/gnutls-devel/2015-February/007471.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2540-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-8155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-0282","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-0294","description":"GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.","status":"published","published":"2020-01-27T15:12:11Z","modified":"2024-08-06T04:03:10.95Z","updated_at":"2026-11-02T14:35:45.428221Z"}],"euvd":[{"id":"EUVD-2015-0307","description":"GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.","status":"published","published":"2020-01-27T15:12:11Z","modified":"2024-08-06T04:03:10Z","updated_at":"2026-11-03T02:22:20.481932Z"}],"ghsa":[{"id":"GHSA-xqm3-jfj9-8pf2","title":"GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a...","description":"GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.","status":"published","published":"2022-05-24T17:07:24Z","modified":"2024-04-04T02:46:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:56:12.154453Z"}],"nvd":[{"id":"CVE-2015-0294","description":"GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.","status":"published","published":"2020-01-27T16:15:10.953Z","modified":"2026-06-17T00:19:56.043Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:03:19.73542Z"}],"osv":[{"id":"CVE-2015-0294","description":"GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.","status":"published","published":"2020-01-27T16:15:10Z","modified":"2026-04-16T06:22:03.504454114Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2015-0294","description":"GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.","status":"published","published":"2020-01-27T16:15:10.953Z","modified":"2026-09-09T07:00:05.352309137Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"UBUNTU-CVE-2015-0294","description":"GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.","status":"published","published":"2015-03-01T00:00:00Z","modified":"2026-04-22T10:00:32.75973Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:09.721803Z"},{"id":"DLA-180-1","title":"gnutls26 - security update","status":"published","published":"2015-03-25T00:00:00Z","modified":"2026-03-09T01:23:20.361353Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-3191-1","title":"gnutls26 - security update","status":"published","published":"2015-03-15T00:00:00Z","modified":"2026-03-09T01:19:46.04443Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2015-0322","title":"Updated gnutls packages fix security vulnerabilities","description":"It was reported that GnuTLS does not check whether the two signature\nalgorithms match on certificate import (CVE-2015-0294).\n\nKurt Roeckx discovered that decoding a specific certificate with very long\nDistinguishedName (DN) entries leads to double free. A remote attacker can\ntake advantage of this flaw by creating a specially crafted certificate that,\nwhen processed by an application compiled against GnuTLS, could cause the\napplication to crash resulting in a denial of service (CVE-2015-6251).\n","status":"published","published":"2015-08-25T18:17:48Z","modified":"2026-04-16T06:23:04.890564287Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"RHSA-2015:1457","title":"Red Hat Security Advisory: gnutls security and bug fix update","status":"published","published":"2024-09-15T22:18:32Z","modified":"2026-06-26T12:21:49.257993576Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"SUSE-SU-2015:0675-1","title":"Security update for gnutls","description":"\nGnuTLS has been patched to ensure proper parsing of session ids during the \nTLS/SSL handshake. Additionally, three issues inherited from libtasn1 have \nbeen fixed.\n\nFurther information is available at \nhttp://www.gnutls.org/security.html#GNUTLS-SA-2014-3\n\u003chttp://www.gnutls.org/security.html#GNUTLS-SA-2014-3\u003e\n\nThese security issues have been fixed:\n\n    * Possible memory corruption during connect (CVE-2014-3466)\n    * Multiple boundary check issues could allow DoS (CVE-2014-3467)\n    * asn1_get_bit_der() can return negative bit length (CVE-2014-3468)\n    * Possible DoS by NULL pointer dereference (CVE-2014-3469)\n\nSecurity Issue references:\n\n    * CVE-2014-3466\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3466\u003e\n\n","status":"published","published":"2014-06-03T20:02:07Z","modified":"2026-02-04T02:21:56.022429Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0735-1","title":"Security update for gnutls","description":"\ngnutls was updated to fix a certificate algorithm consistency checking issue. (CVE-2015-0294)\n","status":"published","published":"2015-03-23T13:04:00Z","modified":"2026-02-04T04:03:18.200681Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"USN-2540-1","title":"gnutls26, gnutls28 vulnerabilities","description":"It was discovered that GnuTLS did not perform date and time checks on\nCA certificates, contrary to expectations. This issue only affected\nUbuntu 10.04 LTS. (CVE-2014-8155)\n\nNikos Mavrogiannopoulos discovered that GnuTLS incorrectly verified that\nsignature algorithms matched. A remote attacker could possibly use this\nissue to downgrade to a disallowed algorithm. This issue only affected\nUbuntu 10.04 LTS, Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-0282)\n\nIt was discovered that GnuTLS incorrectly verified certificate algorithms.\nA remote attacker could possibly use this issue to downgrade to a\ndisallowed algorithm. (CVE-2015-0294)\n","status":"published","published":"2015-03-23T19:13:13Z","modified":"2026-04-22T09:10:00.928608Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}