---
title: "CVE-2009-1417\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2009-1417?format=md
keywords: index, follow
---

# CVE-2009-1417

Publication date 30 April 2009

Last updated 24 July 2024

---

Ubuntu priority

**Low**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

Toggle side navigation

## Description

gnutls-cli in GnuTLS before 2.6.6 does not verify the activation and
expiration times of X.509 certificates, which allows remote attackers to
successfully present a certificate that is (1) not yet valid or (2) no
longer valid, related to lack of time checks in the
\_gnutls\_x509\_verify\_certificate function in lib/x509/verify.c in
libgnutls\_x509, as used by (a) Exim, (b) OpenLDAP, and (c) libsoup.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2009-1417?format=md#notes)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| gnutls11 | 9.04 jaunty | Not in release |
| 8.10 intrepid | Not in release |
| 8.04 LTS hardy | Not in release |
| 6.06 LTS dapper | Ignored |
| gnutls12 | 9.04 jaunty | Not in release |
| 8.10 intrepid | Not in release |
| 8.04 LTS hardy | Not in release |
| 6.06 LTS dapper | Ignored |
| gnutls13 | 9.04 jaunty | Not in release |
| 8.10 intrepid | Not in release |
| 8.04 LTS hardy | Ignored |
| 6.06 LTS dapper | Not in release |
| gnutls26 | 9.04 jaunty | Ignored |
| 8.10 intrepid | Ignored |
| 8.04 LTS hardy | Not in release |
| 6.06 LTS dapper | Not in release |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Notes

---

### [jdstrand](https://launchpad.net/~jdstrand)

from Debian: "[lenny] - gnutls26 <no-dsa> (Minor issue, explicitly
labeled as a test program)"
from upstream: "We are concerned that changing the semantics of an
existing function in this way may be seen as backwards incompatible, but we
believe having a default-secure mode should carry more weight here."
problem is that while gnutls-cli does report the expiration
properly, it does not exit with error if the certificate is not active
or expired. The upstream patches are not backwards compatible and the
risk of regression in changing the library far outweighs the security
benefit of applying this patch to adjust the return code for gnutls-bin.
It is possible to adjust the return code of gnutls-bin, but this would
require diverging from upstream and causing maintenance problems down the
road.

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1417)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2009-1417)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2009-1417)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2009-1417)

### Other references

* <http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3517>
* <https://www.cve.org/CVERecord?id=CVE-2009-1417>