Vulnerability Details CVE-2009-5144
mod-gnutls does not validate client certificates when "GnuTLSClientVerify require" is set in a directory context, which allows remote attackers to spoof clients via a crafted certificate.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 38.0%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
- http://issues.outoforder.cc/view.php?id=93
- http://www.openwall.com/lists/oss-security/2015/02/26/6
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=578663
- https://bugzilla.redhat.com/show_bug.cgi?id=1197127
- http://issues.outoforder.cc/view.php?id=93
- http://www.openwall.com/lists/oss-security/2015/02/26/6
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=578663
- https://bugzilla.redhat.com/show_bug.cgi?id=1197127
Products affected by CVE-2009-5144
-
cpe:2.3:a:mod_gnutls_project:mod_gnutls:-