Description
GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is (1) not yet valid or (2) no longer valid.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | gnutls26 | 2.8.6-1+squeeze5 | DLA-180-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | gnutls +3 | 2.8.5-18.el6 | RHSA-2015:1457 |
Advisories 2
- RHSA-2015:1457 Red Hat Security Advisory: gnutls security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DLA-180-1 gnutls26 - security update Debian Security (DSA / DLA) · Mar 9, 2026