Candidate: CVE-2009-5138
PublicDate: 2014-03-07 00:10:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5138
 http://www.openwall.com/lists/oss-security/2014/02/27
Description:
 GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is
 not enabled, treats version 1 X.509 certificates as intermediate CAs, which
 allows remote attackers to bypass intended restrictions by leveraging a
 X.509 V1 certificate from a trusted CA to issue new certificates, a
 different vulnerability than CVE-2014-1959.
Ubuntu-Description:
Notes:
 mdeslaur> before 2.7.6 only
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS: 

Patches_gnutls26:
upstream_gnutls26: released (2.7.6)
lucid_gnutls26: not-affected
precise_gnutls26: not-affected
quantal_gnutls26: not-affected
saucy_gnutls26: not-affected
devel_gnutls26: not-affected