CVE-2016-7444 Security feature bypass in n/a
Attackers can bypass certificate validation in GnuTLS by exploiting unverified serial lengths in OCSP responses, potentially allowing the use of revoked or invalid certificates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-7444?
CVE-2016-7444 is a high-severity vulnerability in Gnu Gnutls, published on 27 Sep 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc.
Weakness: CWE-264
Which versions are affected by CVE-2016-7444?
It affects 1 product.
Products include Gnu Gnutls.
How do I fix CVE-2016-7444?
Upgrade to a fixed version.
Is CVE-2016-7444 being exploited?
There is no known exploitation of CVE-2016-7444 in the wild and no public exploit code.
Other vulnerabilities in Gnu Gnutls
Sources
Also known as ALPINE-CVE-2016-7444, DEBIAN-CVE-2016-7444, GHSA-3ccg-r3xv-q4cg, MGASA-2016-0326, UBUNTU-CVE-2016-7444.