High severity · published Sep 27, 2016
CVE-2016-7444
The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow…
7.5
CVSS
2.4%
EPSS
No
On KEV
Description
The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GN
Gnutls · Gnu
through 3.4.14; 3.5.0; 3.5.1; 3.5.2; 3.5.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-7444
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-7444
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html
www.securityfocus.com
http://www.securityfocus.com/bid/92893
access.redhat.com
https://access.redhat.com/errata/RHSA-2017:2292
Patch
https://gitlab.com/gnutls/gnutls/commit/964632f37dfdfb914ebc5e49db4fa29af35b1de9
Mailing List
https://lists.gnupg.org/pipermail/gnutls-devel/2016-September/008146.html
Vendor Advisory
https://www.gnutls.org/security.html
More from Gnutls
9.8
CVE-2026-42010
Gnutls: gnutls: authentication bypass via nul character in username
9.8
CVE-2021-20232
A flaw was found in gnutls
9.8
CVE-2021-20231
A flaw was found in gnutls
9.8
CVE-2017-5337
Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted…
9.8
CVE-2017-5336
Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified…