CVE-2015-2091 The authentication hook (mgs_hook_authz) in mod-gnutls 0.5.10 and earlier does not validate client certificates when "GnuTLSClientVerify require" is set, which allows remote attackers to spoof clients...
MediumCVSS 5.0
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The authentication hook (mgs_hook_authz) in mod-gnutls 0.5.10 and earlier does not validate client certificates when "GnuTLSClientVerify require" is set, which allows remote attackers to spoof clients via a crafted certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache mod-gnutls | <= 0.5.1 | No fix listed |
References
- issues.outoforder.cc vendor-advisory
- DSA-3177 vendor-advisory
- bugs.debian.org
- GLSA-201709-04 vendor-advisory