p PatchFirst

CVE-2025-32989

CVE-2025-32989 · Gnutls: vulnerability in gnutls sct extension parsing

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly.

CVSS 5.3 · Medium · EPSS 1.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • red hat enterprise linux 10

    Versions
    • ≥ 0:3.8.9-9.el10_0.14: Not affected (rpm)

    No fix published

  • red hat enterprise linux 9

    Versions
    • ≥ 0:3.8.3-6.el9_6.2: Not affected (rpm)

    No fix published

  • red hat enterprise linux 9.2 update services for sap solutions

    Versions
    • ≥ 0:3.7.6-21.el9_2.4: Not affected (rpm)

    No fix published

  • red hat enterprise linux 9.4 extended update support

    Versions
    • ≥ 0:3.8.3-4.el9_4.4: Not affected (rpm)

    No fix published

  • red hat ceph storage 7

    Versions
    • ≥ 7: Not affected (rpm)

    No fix published

  • red hat discovery 2

    Versions
    • ≥ 2.3.0-1760554384: Not affected (rpm)

    No fix published

  • red hat hardened images

    Versions
    • ≥ 3.8.12-1.1.hum1: Not affected (rpm)

    No fix published

  • red hat insights proxy 1.5

    Versions
    • ≥ 1.5.7-1759331989: Not affected (rpm)

    No fix published

  • red hat enterprise linux 6

    No fix published

  • red hat enterprise linux 7

    No fix published

  • red hat enterprise linux 8

    No fix published

  • red hat openshift container platform 4

    No fix published

  • gnutls28 Debian:12

    Versions
    • 3.7.9-2
    • 3.7.9-2+deb12u1
    • 3.7.9-2+deb12u2
    • 3.7.9-2+deb12u3
    • 3.7.9-2+deb12u4
    Affected ranges
    • ECOSYSTEM: < 3.7.9-2+deb12u5

    Update to 3.7.9-2+deb12u5

  • gnutls28 Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.8.9-3

    Update to 3.8.9-3

  • gnutls28 Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.8.9-3

    Update to 3.8.9-3

  • gnutls28 Ubuntu:22.04:LTS

    Versions
    • 3.7.1-5ubuntu1
    • 3.7.2-2ubuntu1
    • 3.7.2-4ubuntu1
    • 3.7.2-5ubuntu1
    • 3.7.3-4ubuntu1
    • 3.7.3-4ubuntu1.1
    • 3.7.3-4ubuntu1.2
    • 3.7.3-4ubuntu1.3
    • 3.7.3-4ubuntu1.4
    • 3.7.3-4ubuntu1.5
    • 3.7.3-4ubuntu1.6
    Affected ranges
    • ECOSYSTEM: < 3.7.3-4ubuntu1.7

    Update to 3.7.3-4ubuntu1.7

  • gnutls28 Ubuntu:Pro:FIPS-preview:22.04:LTS

    Versions
    • 3.7.3-4ubuntu1.2+Fips1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnutls28 Ubuntu:Pro:FIPS-updates:22.04:LTS

    Versions
    • 3.7.3-4ubuntu1.2+Fips1.1
    • 3.7.3-4ubuntu1.3+Fips1.1
    • 3.7.3-4ubuntu1.4+Fips1
    • 3.7.3-4ubuntu1.5+Fips1
    • 3.7.3-4ubuntu1.6+Fips1
    Affected ranges
    • ECOSYSTEM: < 3.7.3-4ubuntu1.7+Fips1

    Update to 3.7.3-4ubuntu1.7+Fips1

  • gnutls28 Ubuntu:24.04:LTS

    Versions
    • 3.8.1-4ubuntu1
    • 3.8.1-4ubuntu6
    • 3.8.1-4ubuntu7
    • 3.8.3-1ubuntu1
    • 3.8.3-1.1ubuntu2
    • 3.8.3-1.1ubuntu3
    • 3.8.3-1.1ubuntu3.1
    • 3.8.3-1.1ubuntu3.2
    • 3.8.3-1.1ubuntu3.3
    Affected ranges
    • ECOSYSTEM: < 3.8.3-1.1ubuntu3.4

    Update to 3.8.3-1.1ubuntu3.4

  • gnutls28 Ubuntu:Pro:FIPS-updates:24.04:LTS

    Versions
    • 3.8.3-1.1ubuntu3.1+Fips1
    Affected ranges
    • ECOSYSTEM: < 3.8.3-1.1ubuntu3.4+Fips1

    Update to 3.8.3-1.1ubuntu3.4+Fips1

  • gnutls28 Ubuntu:25.10

    Versions
    • 3.8.9-2ubuntu3
    Affected ranges
    • ECOSYSTEM: < 3.8.9-3ubuntu1

    Update to 3.8.9-3ubuntu1

Original sources

Check your server →