CVE-2008-4989: Canonical Ubuntu Linux

Medium severity, CVSS 5.9. EPSS: 1.9% chance of exploitation in the next 30 days.

The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 7.10 only; version 8.04 only; version 8.10 only
• Debian Debian Linux: version 4.0 only
• Fedoraproject Fedora: version 8 only; version 9 only
• GNU Gnutls: before 2.6.1 (fixed in 2.6.1)
• Opensuse Opensuse: from 10.3, up to and including 11.1
• Suse Linux Enterprise: version 10.0 only; version 11.0 only
• Suse Linux Enterprise Server: version 10 only; version 11 only

Published 2008-11-13. Last modified 2026-06-16.