Vulnerability in Apache Mod-Gnutls
CVE-2015-2091
The authentication hook (mgs_hook_authz) in mod-gnutls 0.5.10 and earlier does not validate client certificates when "GnuTLSClientVerify require" is set, which allows remote attackers to spoof clients via a crafted certificate.
Vulnerability class: POODLE (CVE-2014-3566)
EPSS: 0.033 (87.0th percentile) — read the EPSS interpretation.
Affected products
- Apache Mod-gnutls
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vendor-advisory, x_refsource_GENTOO)
- cve@mitre.org (vendor-advisory, x_refsource_DEBIAN)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (x_refsource_MISC, Vendor Advisory)