Unscored severity · published Apr 30, 2009
CVE-2009-1416
lib/gnutls_pk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the intended DSA keys, which might allow remote attackers to…
–
CVSS
3.9%
EPSS
No
On KEV
Description
lib/gnutls_pk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the intended DSA keys, which might allow remote attackers to spoof signatures on certificates or have unspecified other impact by leveraging an invalid DSA key.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GN
Gnutls · Gnu
2.5.0; 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-1416
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-1416
Exploit
http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516
Vendor Advisory
http://lists.gnu.org/archive/html/help-gnutls/2009-04/msg00018.html
Vendor Advisory
http://secunia.com/advisories/34842
secunia.com
http://secunia.com/advisories/35211
security.gentoo.org
http://security.gentoo.org/glsa/glsa-200905-04.xml
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2009:116
More from Gnutls
9.8
CVE-2026-42010
Gnutls: gnutls: authentication bypass via nul character in username
9.8
CVE-2021-20232
A flaw was found in gnutls
9.8
CVE-2021-20231
A flaw was found in gnutls
9.8
CVE-2017-5337
Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted…
9.8
CVE-2017-5336
Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified…