CVE-2008-4989: canonical ubuntu_linux Improper Certificate Validation

Modified

AliasesRHSA-2008:0982DSA-1719-1

Published 13-11-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-4989 is a medium (CVSS 5.9) Improper Certificate Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 1.88% chance of exploitation in the next 30 days, higher than 79.4% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.9/10

010

Medium · v3.1 (NVD)

EPSS score

1.88%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

OPENSUSE-SU-2024:10105-1

Timeline

13-11-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).

CVSS metrics

2 scores · 1 source · 2 versions

v3.15.9v2.04.3

EPSS trend

Probability

1.88%

Chance of exploitation in the next 30 days

Percentile

79%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.88% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat4 products

gnutls< 0:1.4.1-3.el5_2.1
gnutls-debuginfo< 0:1.4.1-3.el5_2.1
gnutls-devel< 0:1.4.1-3.el5_2.1
gnutls-utils< 0:1.4.1-3.el5_2.1

Debian2 products

gnutls13< 1.4.4-3+etch3
debian_linuxEOL4.0

Suse2 products

linux_enterprise10.0 | 11.0
linux_enterprise_server10 | 11

Canonical1 product

ubuntu_linuxEOL6.06 | 7.10 | 8.04 | 8.10

Fedoraproject1 product

fedoraEOL8 | 9

Gnu1 product

gnutls< 2.6.1

Opensuse1 product

opensuse≥ 10.3, ≤ 11.1

7 vendors · 12 products

References

37 links

www.mandriva.com/security/advisories?name=MDVSA-2008:227Vendor AdvisoryX Refsource MANDRIVABroken Link
www.ubuntu.com/usn/usn-678-2Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
secunia.com/advisories/33694Third Party AdvisoryX Refsource SECUNIABroken Link
security.gentoo.org/glsa/glsa-200901-10.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www.redhat.com/support/errata/RHSA-2008-0982.htmlVendor AdvisoryX Refsource REDHATBroken Link
usn.ubuntu.com/678-1/Vendor AdvisoryX Refsource UBUNTUBroken Link
www.securityfocus.com/archive/1/498431/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3215Mailing ListX Refsource MLISTBroken LinkPatch
article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217Mailing ListX Refsource MLISTBroken Link
wiki.rpath.com/Advisories:rPSA-2008-0322X Refsource CONFIRMBroken Link

Show all 37 references

secunia.com/advisories/32687Third Party AdvisoryX Refsource SECUNIABroken Link
www.redhat.com/archives/fedora-package-announce/2008-November/msg00293.htmlVendor AdvisoryX Refsource FEDORAMailing List
www.gnu.org/software/gnutls/security.htmlX Refsource CONFIRMProduct
issues.rpath.com/browse/RPL-2886X Refsource CONFIRMBroken Link
secunia.com/advisories/35423Third Party AdvisoryX Refsource SECUNIABroken Link
lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.htmlVendor AdvisoryX Refsource SUSEMailing List
www.securityfocus.com/bid/32232VDB EntryX Refsource BIDBroken LinkPatchThird Party Advisory
www.securitytracker.com/id?1021167VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
sunsolve.sun.com/search/document.do?assetkey=1-26-260528-1Vendor AdvisoryX Refsource SUNALERTBroken Link
secunia.com/advisories/33501Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/32879Third Party AdvisoryX Refsource SECUNIABroken Link
www.vupen.com/english/advisories/2009/1567VDB EntryX Refsource VUPENBroken Link
secunia.com/advisories/32619Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.vupen.com/english/advisories/2008/3086VDB EntryX Refsource VUPENBroken Link
secunia.com/advisories/32681Third Party AdvisoryX Refsource SECUNIABroken Link
lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.htmlVendor AdvisoryX Refsource SUSEMailing List
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11650VDB EntrySignatureX Refsource OVALBroken Link
www.debian.org/security/2009/dsa-1719Vendor AdvisoryX Refsource DEBIANMailing List
www.redhat.com/archives/fedora-package-announce/2008-November/msg00222.htmlVendor AdvisoryX Refsource FEDORAMailing List
exchange.xforce.ibmcloud.com/vulnerabilities/46482VDB EntryX Refsource XFThird Party Advisory
access.redhat.com/errata/RHSA-2008:0982Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=470079REPORT
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0982.jsonAdvisory
access.redhat.com/security/cve/CVE-2008-4989REPORT
www.cve.org/CVERecord?id=CVE-2008-4989Advisory
nvd.nist.gov/vuln/detail/CVE-2008-4989Advisory