CVE-2009-1416

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-04-30 · updated 2026-06-16
Weakness: CWE-310

Description

lib/gnutls_pk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the intended DSA keys, which might allow remote attackers to spoof signatures on certificates or have unspecified other impact by leveraging an invalid DSA key.

Affected products

[UNKNOWN] gnutls: 2.5.0, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4 (+1)

References

http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516
http://lists.gnu.org/archive/html/help-gnutls/2009-04/msg00018.html
http://secunia.com/advisories/34842
http://secunia.com/advisories/35211
http://security.gentoo.org/glsa/glsa-200905-04.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2009:116
http://www.securityfocus.com/bid/34783
http://www.securitytracker.com/id?1022158
http://www.vupen.com/english/advisories/2009/1218
http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516
http://lists.gnu.org/archive/html/help-gnutls/2009-04/msg00018.html
http://secunia.com/advisories/34842

Get alerted when CVE-2009-1416 or the next vulnerability affects your stack