Sign in Sign up
JA · EN · FR
SecPulse
Other
CVE-2026-42012 high CVSS 7.1

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a...

Other

Summary

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a...

Original description

The description as published by the source.

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

gnutlsに脆弱性が見つかりました。リモート攻撃者が特定の形式の証明書を提示することで、この脆弱性を悪用し、正当なサービスを偽装したり機密情報を傍受する可能性があります。URIやサービスに関するSANが含まれる証明書により、証明書の検証プロセスが誤って進む危険性があります。

❓ What is the problem

gnutlsにおける証明書検証での欠陥です。

📍 Affected scope

gnutlsの証明書検証機構。

🔥 Severity

正当なサービスの偽装や機密情報の傍受が可能になるため、重大です。

🔧 How to fix

gnutlsのアップデートを適用して、証明書の検証プロセスを修正します。

🛡️ Workaround

特定の証明書を信頼しないこと。

🔍 Detection

特定のSANを含む証明書の使用やインシデントを調査することで判定可能です。

Fix status by distribution

Fixed packages published by each distribution for this CVE

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details