CVE-2008-1949

Publication date 21 May 2008

Last updated 24 July 2024

Ubuntu priority

The _gnutls_recv_client_kx_message function in lib/gnutls_kx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service (NULL dereference and crash) via a TLS message containing multiple Client Hello messages, aka GNUTLS-SA-2008-1-2.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
gnutls12	8.04 LTS hardy	Not in release
	7.10 gutsy	Not in release
	7.04 feisty	Not in release
	6.06 LTS dapper	Fixed 1.2.9-2ubuntu1.2
gnutls13	8.04 LTS hardy	Fixed 2.0.4-1ubuntu2.1
	7.10 gutsy	Fixed 1.6.3-1ubuntu0.1
	7.04 feisty	Fixed 1.4.4-3ubuntu0.1
	6.06 LTS dapper	Not in release
gnutls26	8.04 LTS hardy	Not in release
	7.10 gutsy	Not in release
	7.04 feisty	Not in release
	6.06 LTS dapper	Not in release

CVE-2008-1949

Status

References

Related Ubuntu Security Notices (USN)

Other references