CVE-2008-1948
NoneCVSS
—
EPSS
12.0%
Published
May 21, 2008
CISA due date
—
The record
The _gnutls_server_name_recv_params function in lib/ext_server_name.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a zero value for the length of Server Names, which leads to a buffer overflow in session resumption data in the pack_security_parameters function, aka GNUTLS-SA-2008-1-1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:4.0 | gnutls13 | 0 | 1.4.4-3+etch1 |
| Red Hat:enterprise_linux:4::as | gnutls | 0 | 0:1.0.20-4.el4_6 |
| Red Hat:enterprise_linux:4::as | gnutls-debuginfo | 0 | 0:1.0.20-4.el4_6 |
| Red Hat:enterprise_linux:4::as | gnutls-devel | 0 | 0:1.0.20-4.el4_6 |
| Red Hat:enterprise_linux:4::desktop | gnutls | 0 | 0:1.0.20-4.el4_6 |
| Red Hat:enterprise_linux:4::desktop | gnutls-debuginfo | 0 | 0:1.0.20-4.el4_6 |
| Red Hat:enterprise_linux:4::desktop | gnutls-devel | 0 | 0:1.0.20-4.el4_6 |
| Red Hat:enterprise_linux:4::es | gnutls | 0 | 0:1.0.20-4.el4_6 |
| Red Hat:enterprise_linux:4::es | gnutls-debuginfo | 0 | 0:1.0.20-4.el4_6 |
| Red Hat:enterprise_linux:4::es | gnutls-devel | 0 | 0:1.0.20-4.el4_6 |
| Red Hat:enterprise_linux:4::ws | gnutls | 0 | 0:1.0.20-4.el4_6 |
| Red Hat:enterprise_linux:4::ws | gnutls-debuginfo | 0 | 0:1.0.20-4.el4_6 |
| Red Hat:enterprise_linux:4::ws | gnutls-devel | 0 | 0:1.0.20-4.el4_6 |
| Red Hat:enterprise_linux:5::client | gnutls | 0 | 0:1.4.1-3.el5_1 |
| Red Hat:enterprise_linux:5::client | gnutls-debuginfo | 0 | 0:1.4.1-3.el5_1 |
| Red Hat:enterprise_linux:5::client | gnutls-devel | 0 | 0:1.4.1-3.el5_1 |
| Red Hat:enterprise_linux:5::client | gnutls-utils | 0 | 0:1.4.1-3.el5_1 |
| Red Hat:enterprise_linux:5::client_workstation | gnutls | 0 | 0:1.4.1-3.el5_1 |
| Red Hat:enterprise_linux:5::client_workstation | gnutls-debuginfo | 0 | 0:1.4.1-3.el5_1 |
| Red Hat:enterprise_linux:5::client_workstation | gnutls-devel | 0 | 0:1.4.1-3.el5_1 |
| Red Hat:enterprise_linux:5::client_workstation | gnutls-utils | 0 | 0:1.4.1-3.el5_1 |
| Red Hat:enterprise_linux:5::server | gnutls | 0 | 0:1.4.1-3.el5_1 |
| Red Hat:enterprise_linux:5::server | gnutls-debuginfo | 0 | 0:1.4.1-3.el5_1 |
| Red Hat:enterprise_linux:5::server | gnutls-devel | 0 | 0:1.4.1-3.el5_1 |
| Red Hat:enterprise_linux:5::server | gnutls-utils | 0 | 0:1.4.1-3.el5_1 |
| openSUSE:Tumbleweed | gnutls | 0 | 3.7.2-1.2 |
Related vulnerabilities
- CVE-2009-3555 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… Also affects gnutls
- CVE-2014-3467 Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as… Also affects gnutls
- CVE-2014-3466 Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS… Also affects gnutls
- CVE-2014-0092 lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly… Also affects gnutls
- CVE-2026-42014 A flaw was found in GnuTLS. Also affects gnutls
- CVE-2026-5419 A flaw was found in gnutls. Also affects gnutls
- CVE-2026-5260 A flaw was found in libgnutls. Also affects gnutls
- CVE-2026-42015 A flaw was found in gnutls. Also affects gnutls