mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2025-01-25 09:34:11 +00:00
Code Issues Releases Activity

- Document NUL byte problem in gnutls and gnutls-devel

Browse Source 
- Document multiple vulnerabilities in older versions[1]

Note:  These have all been fixed with the exception of the NUL byte problem
in gnutls-devel.

PR:		[1]: ports/134785
Submitted by:	[1]: Eygene Ryabinkin <rea-fbsd@codelabs.ru>
Reviewed by:	miwi
This commit is contained in:
Wesley Shields 2009-08-17 14:37:29 +00:00
parent e0f77cb241
commit f3bdda8556
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=239756
1 changed files with 80 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

80
security/vuxml/vuln.xml
View File

@ -34,6 +34,86 @@ Note: Please add new entries to the beginning of this file.
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="b31a1088-460f-11de-a11a-0022156e8794">
<topic>GnuTLS -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>2.6.6</lt></range>
</package>
<package>
<name>gnutls-devel</name>
<range><lt>2.7.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/34783/discuss">
<p>GnuTLS is prone to multiple remote vulnerabilities:</p>
<ul>
<li>A remote code-execution vulnerability.</li>
<li>A denial-of-service vulnerability.</li>
<li>A signature-generation vulnerability.</li>
<li>A signature-verification vulnerability.</li>
</ul>
<p>An attacker can exploit these issues to potentially execute
arbitrary code, trigger denial-of-service conditions, carry
out attacks against data signed with weak signatures, and
cause clients to accept expired or invalid certificates from
servers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-1415</cvename>
<cvename>CVE-2009-1416</cvename>
<cvename>CVE-2009-1417</cvename>
<bid>34783</bid>
<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3515</url>
<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516</url>
<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3517</url>
</references>
<dates>
<discovery>2009-05-21</discovery>
<entry>2009-08-17</entry>
</dates>
</vuln>
<vuln vid="856a6f84-8b30-11de-8062-00e0815b8da8">
<topic>GnuTLS -- improper SSL certificate verification</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>2.8.3</lt></range>
</package>
<package>
<name>gnutls-devel</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuTLS reports:</p>
<blockquote cite="http://article.gmane.org/gmane.network.gnutls.general/1733">
<p>By using a NUL byte in CN/SAN fields, it was possible to fool
GnuTLS into 1) not printing the entire CN/SAN field value when
printing a certificate and 2) cause incorrect positive matches
when matching a hostname against a certificate.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-2730</cvename>
<url>http://article.gmane.org/gmane.network.gnutls.general/1733</url>
<url>http://secunia.com/advisories/36266</url>
</references>
<dates>
<discovery>2009-08-11</discovery>
<entry>2009-08-17</entry>
</dates>
</vuln>
<vuln vid="86ada694-8b30-11de-b9d0-000c6e274733">
<topic>memcached -- memcached stats maps Information Disclosure Weakness</topic>
<affects>