CVE-2009-1416: gnu gnutls Cryptographic Issues

Vulnerability summary

CVE-2009-1416 is a high (CVSS 7.5) Cryptographic Issues vulnerability in gnu gnutls. EPSS estimates a 3.90% chance of exploitation in the next 30 days, higher than 90.1% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 30-04-2009
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

lib/gnutls_pk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the intended DSA keys, which might allow remote attackers to spoof signatures on certificates or have unspecified other impact by leveraging an invalid DSA key.

• CWE-310Cryptographic IssuesWeaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.