Bug 2467448 (CVE-2026-42013)
| Summary: | CVE-2026-42013 gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, kshier, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, stcannon, suppawar, teagle, vlaad, watson-tool-maintainers, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-05-06 19:48:36 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:26409 https://access.redhat.com/errata/RHSA-2026:26409 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:30004 https://access.redhat.com/errata/RHSA-2026:30004 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:30850 https://access.redhat.com/errata/RHSA-2026:30850 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:30849 https://access.redhat.com/errata/RHSA-2026:30849 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:32962 https://access.redhat.com/errata/RHSA-2026:32962 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:33125 https://access.redhat.com/errata/RHSA-2026:33125 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:41921 https://access.redhat.com/errata/RHSA-2026:41921 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.19 Via RHSA-2026:40762 https://access.redhat.com/errata/RHSA-2026:40762 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:43575 https://access.redhat.com/errata/RHSA-2026:43575 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2026:57483 https://access.redhat.com/errata/RHSA-2026:57483 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2026:56853 https://access.redhat.com/errata/RHSA-2026:56853 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2026:60019 https://access.redhat.com/errata/RHSA-2026:60019 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2026:59831 https://access.redhat.com/errata/RHSA-2026:59831 |