Description
The gnutls_x509_crt_get_serial function in the GnuTLS library before 1.2.1, when running on big-endian, 64-bit platforms, calls the asn1_read_value with a pointer to the wrong data type and the wrong length value, which allows remote attackers to bypass the certificate revocation list (CRL) check and cause a stack-based buffer overflow via a crafted X.509 certificate, related to extraction of a serial number.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | gnutls +1 | 1.0.20-4.el4_8.7 | RHSA-2010:0167 |
Advisories 1
- RHSA-2010:0167 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- RHSA-2010:0167 vendor-advisory
- 39127 third-party-advisory
- MDVSA-2010:089 vendor-advisory
- 38959 vdb-entry
- ADV-2010-0713 vdb-entry
- oval:org.mitre.oval:def:9759 vdb-entry signature
- http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/4230
- https://bugzilla.redhat.com/show_bug.cgi?id=573028
- SUSE-SR:2010:014 vendor-advisory
- ADV-2010-1054 vdb-entry