[ GLSA 201709-04 ] mod_gnutls

[GLSA]

Gentoo Linux Security Advisory

Title: mod_gnutls: Certificate validation error (GLSA 201709-04)
Severity: normal
Exploitable: remote
Date: 2017-09-17
Bug(s): #541038
ID: 201709-04

Synopsis

A vulnerability in mod_gnutls allows remote attackers to spoof
clients via crafted certificates.


Background

mod_gnutls is an extension for ​Apache’s httpd. It uses the
​GnuTLS library to provide HTTPS. It supports some protocols and
features that mod_ssl does not.


Affected Packages

Package: www-apache/mod_gnutls
Vulnerable: < 0.7.3
Unaffected: >= 0.7.3
Architectures: All supported architectures


Description

It was discovered that the authentication hook in mod_gnutls does not
validate client’s certificates even when option
“GnuTLSClientVerify” is set to “require”.


Impact

A remote attacker could present a crafted certificate and spoof clients
data.


Workaround

There is no known workaround at this time.

Resolution

All mod_gnutls users should upgrade to the latest version: