CVE-2012-5821

Publication date 4 November 2012

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to improper use of a certain GnuTLS function.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
lynx	12.10 quantal	Not in release
	12.04 LTS precise	Not in release
	11.10 oneiric	Not in release
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Ignored
lynx-cur	12.10 quantal	Fixed 2.8.8dev.12-2ubuntu0.1
	12.04 LTS precise	Fixed 2.8.8dev.9-2ubuntu0.12.04.1
	11.10 oneiric	Fixed 2.8.8dev.9-2ubuntu0.11.10.1
	10.04 LTS lucid	Fixed 2.8.8dev.2-1ubuntu0.1
	8.04 LTS hardy	Ignored

Notes

jdstrand

2.8.8dev.13 added a call to gnutls_certificate_set_verify_flags(), but it wasn't enough to prompt for self-signed certificates patch submitted upstream fixed in lynx2.8.8dev.15

Severity score breakdown

Parameter	Value
Base score	5.9 · Medium
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	High
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

Related Ubuntu Security Notices (USN)

USN-1642-1
Lynx vulnerabilities
29 November 2012