A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7635-1 advisory.

    It was discovered that GnuTLS incorrectly handled exporting Subject Alternative Name (SAN) entries     containing an otherName. A remote attacker could use this issue to cause GnuTLS to crash, resulting in a     denial of service, or possibly execute arbitrary code. (CVE-2025-32988)

    It was discovered that GnuTLS incorrectly handled parsing the Certificate Transparency (CT) Signed     Certificate Timestamp (SCT) extension. A remote attacker could use this issue to cause GnuTLS to crash,     resulting in a denial of service, or possibly obtain sensitive information. (CVE-2025-32989)

    It was discovered that the GnuTLS certtool utility incorrectly handled parsing certain template files. An     attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2025-32990)

    Stefan Bhler discovered that GnuTLS incorrectly handled parsing certain template files. An attacker     could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service. (CVE-2025-6395)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5962 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5962-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     July 16, 2025                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : gnutls28     CVE ID         : CVE-2025-6395 CVE-2025-32988 CVE-2025-32989 CVE-2025-32990

    Multiple security issues were discovered in GNU TLS, which could result in     denial of service.

    For the stable distribution (bookworm), these problems have been fixed in     version 3.7.9-2+deb12u5.

    We recommend that you upgrade your gnutls28 packages.

    For the detailed security status of gnutls28 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gnutls28

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the c3e1df74-5e73-11f0-95e5-74563cf9e4e9 advisory.

    Daiki Ueno  reports:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-16a24364ce advisory.

    This updates gnutls to the latest upstream release. Notable changes are:

    * PKCS#11 cryptographic provider support
    * Support for kTLS rekeying with kernel 6.14+
    * Support for the almost standardized ML-DSA private key formats

    This also fixes 4 CVEs (CVE-2025-32989, CVE-2025-6395, CVE-2025-32988, and CVE-2025-32990).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
242198	Ubuntu 22.04 LTS / 24.04 LTS / 25.04 : GnuTLS vulnerabilities (USN-7635-1)	Nessus	Ubuntu Local Security Checks	medium
242186	Debian dsa-5962 : gnutls-bin - security update	Nessus	Debian Local Security Checks	medium
242080	FreeBSD : GnuTLS -- multiple vulnerabilities (c3e1df74-5e73-11f0-95e5-74563cf9e4e9)	Nessus	FreeBSD Local Security Checks	medium
242043	Fedora 42 : gnutls (2025-16a24364ce)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2025-32989

medium

Tenable Plugins

medium

medium

medium

medium