title: Gnutls: rejects certificate chain with distributed trust
description: A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.
problem types: Improper Verification of Cryptographic Signature
affected:
{
product: GnuTLS
vendor: n/a
versions:
version: 3.8.3, status: unaffected
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: gnutls
defaultStatus: affected
versions:
version: 0:3.7.6-23.el9_3.3, lessThan: *, versionType: rpm, status: unaffected
cpe: [cpe:/o:redhat:enterprise_linux:9::baseos, cpe:/a:redhat:enterprise_linux:9::appstream]
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: gnutls
defaultStatus: affected
versions:
version: 0:3.7.6-23.el9_3.3, lessThan: *, versionType: rpm, status: unaffected
cpe: [cpe:/o:redhat:enterprise_linux:9::baseos, cpe:/a:redhat:enterprise_linux:9::appstream]
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 9.2 Extended Update Support
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: gnutls
defaultStatus: affected
versions:
version: 0:3.7.6-21.el9_2.2, lessThan: *, versionType: rpm, status: unaffected
cpe: [cpe:/a:redhat:rhel_eus:9.2::appstream, cpe:/o:redhat:rhel_eus:9.2::baseos]
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 6
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: gnutls
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:6
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: cockpit
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:7
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: gnutls
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:7
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: cockpit
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:8
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: gnutls
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:8
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: cockpit
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:9
}
{
vendor: Red Hat
product: Red Hat OpenShift Container Platform 3.11
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: cockpit
defaultStatus: unaffected
cpes: cpe:/a:redhat:openshift:3.11
}
{
product: Fedora
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: cockpit
defaultStatus: affected
}
{
product: Fedora
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: gnutls
defaultStatus: affected
}
metrics:
other: [
content: {'value': 'Moderate', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]
workarounds: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.