EUVD-2025-20927
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
4Tags
Description
A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly.
Analysis
A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly.
Technical Context
Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls. This vulnerability is classified as Improper Certificate Validation (CWE-295).
Affected Products
Affected products: Gnu Gnutls -, Redhat Openshift Container Platform 4.0, Redhat Enterprise Linux 6.0
Remediation
Implement proper access controls. Sanitize error messages in production. Review logging practices to avoid capturing sensitive data.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| upstream | released | 3.8.9-3 |
| jammy | released | 3.7.3-4ubuntu1.7 |
| noble | released | 3.8.3-1.1ubuntu3.4 |
| plucky | released | 3.8.9-2ubuntu3.1 |
| oracular | ignored | end of life, was needs-triage |
| bionic | not-affected | code not present |
| focal | not-affected | code not present |
| xenial | not-affected | code not present |
| questing | released | 3.8.9-3ubuntu1 |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | not-affected | - | - |
| bullseye (security) | fixed | 3.7.1-5+deb11u9 | - |
| bookworm | fixed | 3.7.9-2+deb12u5 | - |
| bookworm (security) | fixed | 3.7.9-2+deb12u6 | - |
| trixie (security), trixie | fixed | 3.8.9-3+deb13u2 | - |
| forky, sid | fixed | 3.8.12-3 | - |
| (unstable) | fixed | 3.8.9-3 | - |
Share
External POC / Exploit Code
Leaving vuln.today