GLSA-201709-04 : mod_gnutls: Certificate validation error
Medium Nessus Plugin ID 103272
SynopsisThe remote Gentoo host is missing one or more security-related patches.
DescriptionThe remote host is affected by the vulnerability described in GLSA-201709-04 (mod_gnutls: Certificate validation error)
It was discovered that the authentication hook in mod_gnutls does not validate client’s certificates even when option “GnuTLSClientVerify” is set to “require”.
A remote attacker could present a crafted certificate and spoof clients data.
There is no known workaround at this time.
SolutionAll mod_gnutls users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=www-apache/mod_gnutls-0.7.3'