What’s Vulnerable › Vulnerabilities

CVE-2008-4989

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2008-11-13 · updated 2026-06-16
• Weakness: CWE-295

Description

The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).

Affected products

• Canonical Ubuntu Linux: 6.06, 7.10, 8.04, 8.10
• Debian Linux: 4.0
• Fedoraproject Fedora: 8, 9
• [UNKNOWN] gnutls: before 2.6.1 — fixed in 2.6.1
• Opensuse: from 10.3 through 11.1
• SUSE Linux Enterprise: 10.0, 11.0
• SUSE Linux Enterprise Server: 10, 11

How to fix

Upgrade to a fixed version: [UNKNOWN] gnutls 2.6.1. Check the vendor advisory for mitigations.

References

• http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3215
• http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217
• http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html
• http://secunia.com/advisories/32619
• http://secunia.com/advisories/32681
• http://secunia.com/advisories/32687
• http://secunia.com/advisories/32879
• http://secunia.com/advisories/33501
• http://secunia.com/advisories/33694
• http://secunia.com/advisories/35423
• http://security.gentoo.org/glsa/glsa-200901-10.xml

Get alerted when CVE-2008-4989 or the next vulnerability affects your stack