CVE-2009-5138

MediumCVSS 5.8/10Last modified Jun 16, 2026

Description

GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates, a different vulnerability than CVE-2014-1959.

Metrics

CVSS 2.0 5.8/10AV:N/AC:M/Au:N/C:P/I:P/A:N

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published
Mar 7, 2014
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2009

CVE-2009-51397.5The SIP implementation on the Gizmo5 software phone provides hashed credentials in a response to an invalid authentication challenge, which CVE-2009-51408.8The SIP implementation on the Linksys SPA2102 phone adapter provides hashed credentials in a response to an invalid authentication challengeCVE-2009-51414.0Format string vulnerability in War FTP Daemon (warftpd) 1.82 RC 12 allows remote authenticated users to cause a denial of service (crash) viCVE-2009-51424.3Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allowsCVE-2009-514310.0GE Healthcare Discovery 530C has a password of #bigguy1 for the (1) acqservice user and (2) wsservice user of the Xeleris System, which has CVE-2009-51447.5mod-gnutls does not validate client certificates when "GnuTLSClientVerify require" is set in a directory context, which allows remote attackCVE-2009-51456.1Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.CVE-2009-51477.3DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names.CVE-2009-51494.3Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 have predictable technician passwords, whiCVE-2009-51506.7Absolute Computrace Agent V80.845 and V80.866 does not have a digital signature for the configuration block, which allows attackers to set uCVE-2009-51516.7The stub component of Absolute Computrace Agent V70.785 executes code from a disk's inter-partition space without requiring a digital signatCVE-2009-51524.1Absolute Computrace Agent, as distributed on certain Dell Inspiron systems through 2009, has a race condition with the Dell Client Configura
CVE-2009-5138: Medium severity, CVSS 5.8 | Vulnix