{"containers":{"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-05-19T00:00:00.000Z","descriptions":[{"lang":"en","value":"Integer signedness error in the _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service (buffer over-read and crash) via a certain integer value in the Random field in an encrypted Client Hello message within a TLS record with an invalid Record Length, which leads to an invalid cipher padding length, aka GNUTLS-SA-2008-1-3."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-11T19:57:01.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"30331","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/30331"},{"name":"31939","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/31939"},{"name":"USN-613-1","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://www.ubuntu.com/usn/usn-613-1"},{"name":"SUSE-SA:2008:046","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00003.html"},{"name":"RHSA-2008:0492","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://www.redhat.com/support/errata/RHSA-2008-0492.html"},{"name":"[oss-security] 20080520 Re: CVE ID request: GNUTLS","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2008/05/20/1"},{"name":"GLSA-200805-20","tags":["vendor-advisory","x_refsource_GENTOO"],"url":"http://security.gentoo.org/glsa/glsa-200805-20.xml"},{"name":"30355","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/30355"},{"name":"30317","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/30317"},{"name":"20080520 Vulnerability Advisory on GnuTLS","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/492282/100/0/threaded"},{"name":"RHSA-2008:0489","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://www.redhat.com/support/errata/RHSA-2008-0489.html"},{"name":"20080522 rPSA-2008-0174-1 gnutls","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/492464/100/0/threaded"},{"name":"[gnutls-devel] 20080519 GnuTLS 2.2.4 - Security release [GNUTLS-SA-2008-1]","tags":["mailing-list","x_refsource_MLIST"],"url":"http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00051.html"},{"tags":["x_refsource_CONFIRM"],"url":"http://sourceforge.net/project/shownotes.php?release_id=600646&group_id=21558"},{"name":"30324","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/30324"},{"name":"30302","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/30302"},{"name":"[gnutls-devel] 20080519 Re: GnuTLS 2.2.4 - Security release [GNUTLS-SA-2008-1]","tags":["mailing-list","x_refsource_MLIST"],"url":"http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00055.html"},{"name":"ADV-2008-1583","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/1583/references"},{"name":"29292","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/29292"},{"name":"FEDORA-2008-4274","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00615.html"},{"name":"30330","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/30330"},{"name":"1020059","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1020059"},{"name":"ADV-2008-1582","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/1582/references"},{"name":"[oss-security] 20080520 Re: CVE ID request: GNUTLS","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2008/05/20/3"},{"name":"VU#659209","tags":["third-party-advisory","x_refsource_CERT-VN"],"url":"http://www.kb.cert.org/vuls/id/659209"},{"tags":["x_refsource_CONFIRM"],"url":"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0174"},{"name":"30338","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/30338"},{"name":"[gnutls-devel] 20080519 GnuTLS 2.2.5 - Brown paper bag release","tags":["mailing-list","x_refsource_MLIST"],"url":"http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00060.html"},{"name":"DSA-1581","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2008/dsa-1581"},{"name":"[oss-security] 20080520 Re: CVE ID request: GNUTLS","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2008/05/20/2"},{"name":"gnutls-gnutlsciphertext2compressed-bo(42533)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42533"},{"name":"FEDORA-2008-4259","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00590.html"},{"name":"3902","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/3902"},{"tags":["x_refsource_CONFIRM"],"url":"https://issues.rpath.com/browse/RPL-2552"},{"name":"30287","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/30287"},{"tags":["x_refsource_CONFIRM"],"url":"http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commitdiff%3Bh=bc8102405fda11ea00ca3b42acc4f4bce9d6e97b"},{"tags":["x_refsource_MISC"],"url":"http://www.cert.fi/haavoittuvuudet/advisory-gnutls.html"},{"name":"FEDORA-2008-4183","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00487.html"},{"name":"oval:org.mitre.oval:def:11393","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11393"},{"name":"MDVSA-2008:106","tags":["vendor-advisory","x_refsource_MANDRIVA"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:106"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","ID":"CVE-2008-1950","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Integer signedness error in the _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service (buffer over-read and crash) via a certain integer value in the Random field in an encrypted Client Hello message within a TLS record with an invalid Record Length, which leads to an invalid cipher padding length, aka GNUTLS-SA-2008-1-3."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"30331","refsource":"SECUNIA","url":"http://secunia.com/advisories/30331"},{"name":"31939","refsource":"SECUNIA","url":"http://secunia.com/advisories/31939"},{"name":"USN-613-1","refsource":"UBUNTU","url":"http://www.ubuntu.com/usn/usn-613-1"},{"name":"SUSE-SA:2008:046","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00003.html"},{"name":"RHSA-2008:0492","refsource":"REDHAT","url":"http://www.redhat.com/support/errata/RHSA-2008-0492.html"},{"name":"[oss-security] 20080520 Re: CVE ID request: GNUTLS","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2008/05/20/1"},{"name":"GLSA-200805-20","refsource":"GENTOO","url":"http://security.gentoo.org/glsa/glsa-200805-20.xml"},{"name":"30355","refsource":"SECUNIA","url":"http://secunia.com/advisories/30355"},{"name":"30317","refsource":"SECUNIA","url":"http://secunia.com/advisories/30317"},{"name":"20080520 Vulnerability Advisory on GnuTLS","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/492282/100/0/threaded"},{"name":"RHSA-2008:0489","refsource":"REDHAT","url":"http://www.redhat.com/support/errata/RHSA-2008-0489.html"},{"name":"20080522 rPSA-2008-0174-1 gnutls","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/492464/100/0/threaded"},{"name":"[gnutls-devel] 20080519 GnuTLS 2.2.4 - Security release [GNUTLS-SA-2008-1]","refsource":"MLIST","url":"http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00051.html"},{"name":"http://sourceforge.net/project/shownotes.php?release_id=600646&group_id=21558","refsource":"CONFIRM","url":"http://sourceforge.net/project/shownotes.php?release_id=600646&group_id=21558"},{"name":"30324","refsource":"SECUNIA","url":"http://secunia.com/advisories/30324"},{"name":"30302","refsource":"SECUNIA","url":"http://secunia.com/advisories/30302"},{"name":"[gnutls-devel] 20080519 Re: GnuTLS 2.2.4 - Security release [GNUTLS-SA-2008-1]","refsource":"MLIST","url":"http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00055.html"},{"name":"ADV-2008-1583","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/1583/references"},{"name":"29292","refsource":"BID","url":"http://www.securityfocus.com/bid/29292"},{"name":"FEDORA-2008-4274","refsource":"FEDORA","url":"https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00615.html"},{"name":"30330","refsource":"SECUNIA","url":"http://secunia.com/advisories/30330"},{"name":"1020059","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1020059"},{"name":"ADV-2008-1582","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/1582/references"},{"name":"[oss-security] 20080520 Re: CVE ID request: GNUTLS","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2008/05/20/3"},{"name":"VU#659209","refsource":"CERT-VN","url":"http://www.kb.cert.org/vuls/id/659209"},{"name":"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0174","refsource":"CONFIRM","url":"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0174"},{"name":"30338","refsource":"SECUNIA","url":"http://secunia.com/advisories/30338"},{"name":"[gnutls-devel] 20080519 GnuTLS 2.2.5 - Brown paper bag release","refsource":"MLIST","url":"http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00060.html"},{"name":"DSA-1581","refsource":"DEBIAN","url":"http://www.debian.org/security/2008/dsa-1581"},{"name":"[oss-security] 20080520 Re: CVE ID request: GNUTLS","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2008/05/20/2"},{"name":"gnutls-gnutlsciphertext2compressed-bo(42533)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42533"},{"name":"FEDORA-2008-4259","refsource":"FEDORA","url":"https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00590.html"},{"name":"3902","refsource":"SREASON","url":"http://securityreason.com/securityalert/3902"},{"name":"https://issues.rpath.com/browse/RPL-2552","refsource":"CONFIRM","url":"https://issues.rpath.com/browse/RPL-2552"},{"name":"30287","refsource":"SECUNIA","url":"http://secunia.com/advisories/30287"},{"name":"http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=bc8102405fda11ea00ca3b42acc4f4bce9d6e97b","refsource":"CONFIRM","url":"http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=bc8102405fda11ea00ca3b42acc4f4bce9d6e97b"},{"name":"http://www.cert.fi/haavoittuvuudet/advisory-gnutls.html","refsource":"MISC","url":"http://www.cert.fi/haavoittuvuudet/advisory-gnutls.html"},{"name":"FEDORA-2008-4183","refsource":"FEDORA","url":"https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00487.html"},{"name":"oval:org.mitre.oval:def:11393","refsource":"OVAL","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11393"},{"name":"MDVSA-2008:106","refsource":"MANDRIVA","url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:106"}]}}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-07T08:41:00.178Z"},"title":"CVE Program Container","references":[{"name":"30331","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/30331"},{"name":"31939","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/31939"},{"name":"USN-613-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/usn-613-1"},{"name":"SUSE-SA:2008:046","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00003.html"},{"name":"RHSA-2008:0492","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://www.redhat.com/support/errata/RHSA-2008-0492.html"},{"name":"[oss-security] 20080520 Re: CVE ID request: GNUTLS","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2008/05/20/1"},{"name":"GLSA-200805-20","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"],"url":"http://security.gentoo.org/glsa/glsa-200805-20.xml"},{"name":"30355","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/30355"},{"name":"30317","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/30317"},{"name":"20080520 Vulnerability Advisory on GnuTLS","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/492282/100/0/threaded"},{"name":"RHSA-2008:0489","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://www.redhat.com/support/errata/RHSA-2008-0489.html"},{"name":"20080522 rPSA-2008-0174-1 gnutls","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/492464/100/0/threaded"},{"name":"[gnutls-devel] 20080519 GnuTLS 2.2.4 - Security release [GNUTLS-SA-2008-1]","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00051.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://sourceforge.net/project/shownotes.php?release_id=600646&group_id=21558"},{"name":"30324","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/30324"},{"name":"30302","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/30302"},{"name":"[gnutls-devel] 20080519 Re: GnuTLS 2.2.4 - Security release [GNUTLS-SA-2008-1]","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00055.html"},{"name":"ADV-2008-1583","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/1583/references"},{"name":"29292","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/29292"},{"name":"FEDORA-2008-4274","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00615.html"},{"name":"30330","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/30330"},{"name":"1020059","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1020059"},{"name":"ADV-2008-1582","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/1582/references"},{"name":"[oss-security] 20080520 Re: CVE ID request: GNUTLS","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2008/05/20/3"},{"name":"VU#659209","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"],"url":"http://www.kb.cert.org/vuls/id/659209"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0174"},{"name":"30338","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/30338"},{"name":"[gnutls-devel] 20080519 GnuTLS 2.2.5 - Brown paper bag release","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00060.html"},{"name":"DSA-1581","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2008/dsa-1581"},{"name":"[oss-security] 20080520 Re: CVE ID request: GNUTLS","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2008/05/20/2"},{"name":"gnutls-gnutlsciphertext2compressed-bo(42533)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42533"},{"name":"FEDORA-2008-4259","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00590.html"},{"name":"3902","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/3902"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://issues.rpath.com/browse/RPL-2552"},{"name":"30287","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/30287"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commitdiff%3Bh=bc8102405fda11ea00ca3b42acc4f4bce9d6e97b"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.cert.fi/haavoittuvuudet/advisory-gnutls.html"},{"name":"FEDORA-2008-4183","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00487.html"},{"name":"oval:org.mitre.oval:def:11393","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11393"},{"name":"MDVSA-2008:106","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:106"}]}]},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2008-1950","datePublished":"2008-05-21T10:00:00.000Z","dateReserved":"2008-04-24T00:00:00.000Z","dateUpdated":"2024-08-07T08:41:00.178Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"}