CVE-2024-55581 Security feature bypass in n/a
Man-in-the-middle attacks are possible because the Ada Web Server client does not verify HTTPS server certificates by default when linked with GnuTLS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-55581?
CVE-2024-55581 is a high-severity vulnerability in Debian Debian Linux, published on 26 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When AdaCore Ada Web Server 25.0.0 is linked with GnuTLS, the default behaviour of AWS.Client is vulnerable to a man-in-the-middle attack because of lack of verification of an HTTPS server's certificate (unless the using program specifies a TLS configuration).
Weakness: CWE-295
Which versions are affected by CVE-2024-55581?
It affects 2 products.
Products include Adacore Ada Web Server, Debian Debian Linux.
How do I fix CVE-2024-55581?
Apply the vendor's patch.
Is CVE-2024-55581 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-55581 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2024-55581, DLA-4080-1, GHSA-6pc8-5263-hvgq, UBUNTU-CVE-2024-55581.