Improper Certificate Validation in GnuTLS Causes DoS

Executive Summary

This vulnerability is an improper certificate validation flaw in GnuTLS version 3.8.13. It causes the application to incorrectly reject legitimate certificates for valid users, resulting in a Denial of Service (DoS). The issue stems from a failure to enforce permittedSubtrees constraints for directoryName and URI name forms in certificate validation.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses GnuTLS version 3.8.13. Run 'gnutls-cli --version' to verify the installed version. If vulnerable, inspect certificate chains for permittedSubtrees constraints violations in directoryName or URI forms.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker controlling a subordinate Certificate Authority (CA) to issue end-entity certificates outside the permitted namespace. GnuTLS-based clients would accept these certificates, enabling impersonation of organizations or URI domains that the constraints were meant to restrict. This could lead to unauthorized access or service disruption.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade GnuTLS to a patched version immediately. Avoid using GnuTLS 3.8.13. If upgrading is not possible, disable certificate validation temporarily as a last resort.

Useful 0 Not Useful 0