CVE-2008-4989

The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).

• CWE-295

• http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3215Broken Link, Patch
• http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217Broken Link
• http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.htmlMailing List
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.htmlMailing List
• http://secunia.com/advisories/32619Broken Link, Vendor Advisory
• http://secunia.com/advisories/32681Broken Link
• http://secunia.com/advisories/32687Broken Link
• http://secunia.com/advisories/32879Broken Link
• http://secunia.com/advisories/33501Broken Link
• http://secunia.com/advisories/33694Broken Link
• http://secunia.com/advisories/35423Broken Link
• http://security.gentoo.org/glsa/glsa-200901-10.xmlThird Party Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-260528-1Broken Link
• http://wiki.rpath.com/Advisories:rPSA-2008-0322Broken Link
• http://www.debian.org/security/2009/dsa-1719Mailing List
• http://www.gnu.org/software/gnutls/security.htmlProduct
• http://www.mandriva.com/security/advisories?name=MDVSA-2008:227Broken Link
• http://www.redhat.com/support/errata/RHSA-2008-0982.htmlBroken Link
• http://www.securityfocus.com/archive/1/498431/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/32232Broken Link, Patch, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1021167Broken Link, Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/usn-678-2Third Party Advisory
• http://www.vupen.com/english/advisories/2008/3086Broken Link
• http://www.vupen.com/english/advisories/2009/1567Broken Link
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46482Third Party Advisory, VDB Entry
• https://issues.rpath.com/browse/RPL-2886Broken Link
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11650Broken Link
• https://usn.ubuntu.com/678-1/Broken Link
• https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00222.htmlMailing List
• https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00293.htmlMailing List
• http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3215Broken Link, Patch
• http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217Broken Link
• http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.htmlMailing List
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.htmlMailing List
• http://secunia.com/advisories/32619Broken Link, Vendor Advisory
• http://secunia.com/advisories/32681Broken Link
• http://secunia.com/advisories/32687Broken Link
• http://secunia.com/advisories/32879Broken Link
• http://secunia.com/advisories/33501Broken Link
• http://secunia.com/advisories/33694Broken Link
• http://secunia.com/advisories/35423Broken Link
• http://security.gentoo.org/glsa/glsa-200901-10.xmlThird Party Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-260528-1Broken Link
• http://wiki.rpath.com/Advisories:rPSA-2008-0322Broken Link
• http://www.debian.org/security/2009/dsa-1719Mailing List
• http://www.gnu.org/software/gnutls/security.htmlProduct
• http://www.mandriva.com/security/advisories?name=MDVSA-2008:227Broken Link
• http://www.redhat.com/support/errata/RHSA-2008-0982.htmlBroken Link
• http://www.securityfocus.com/archive/1/498431/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/32232Broken Link, Patch, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1021167Broken Link, Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/usn-678-2Third Party Advisory
• http://www.vupen.com/english/advisories/2008/3086Broken Link
• http://www.vupen.com/english/advisories/2009/1567Broken Link
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46482Third Party Advisory, VDB Entry
• https://issues.rpath.com/browse/RPL-2886Broken Link
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11650Broken Link
• https://usn.ubuntu.com/678-1/Broken Link
• https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00222.htmlMailing List
• https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00293.htmlMailing List

Published

Nov 13, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-4983scilab-bin 4.1.2 allows local users to overwrite arbitrary f…
• CVE-2008-4984scratchbox2 1.99.0.24 allows local users to overwrite arbitr…
• CVE-2008-4985vdrleaktest in Video Disk Recorder (aka vdr-dbg or vdr) 1.6.…
• CVE-2008-4986wims 3.62 allows local users to overwrite arbitrary files vi…
• CVE-2008-4987xastir 1.9.2 allows local users to overwrite arbitrary files…
• CVE-2008-4988pscal in xcal 4.1 allows local users to overwrite arbitrary …
• CVE-2008-4990Enomaly Elastic Computing Platform (ECP), formerly Enomalism…
• CVE-2008-4991SQL injection vulnerability in LOCKON CO.,LTD. EC-CUBE 2.3.0…
• CVE-2008-4992The SPARC hypervisor in Sun System Firmware 6.6.3 through 6.…
• CVE-2008-4993qemu-dm.debug in Xen 3.2.1 allows local users to overwrite a…
• CVE-2008-4994The (1) ncsarmt and (2) ncsawrap scripts in xmcd 2.6 allows …
• CVE-2008-4995redirect.pl in bk2site 1.1.9 allows local users to overwrite…