CVE & CISA-KEV Catalog

CVE-2025-32989

MEDIUM
5.3
CVSS v3
NVD

Description

A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly.

CWE-295Improper Certificate Validation

How to fix

Remediation Available
gnutls28Debian
Fixed in:3.7.9-2+deb12u5CVE-2025-32989
Fixed in:3.8.9-3CVE-2025-32989
Fixed in:3.8.9-3CVE-2025-32989
gnutlsRed Hat / RHEL
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
gnutlsRocky
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
gnutls-c++Rocky
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
gnutls-c++Red Hat / RHEL
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
gnutls-c++-debuginfoRocky
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
gnutls-c++-debuginfoRed Hat / RHEL
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
gnutls-daneRocky
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
gnutls-daneRed Hat / RHEL
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
gnutls-dane-debuginfoRocky
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
gnutls-dane-debuginfoRed Hat / RHEL
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
gnutls-debuginfoRocky
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
gnutls-debuginfoRed Hat / RHEL
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
gnutls-debugsourceRed Hat / RHEL
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
gnutls-debugsourceRocky
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
gnutls-develRed Hat / RHEL
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
gnutls-develRocky
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
gnutls-fipsRed Hat / RHEL
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
gnutls-fipsRocky
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
gnutls-utilsRocky
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
gnutls-utilsRed Hat / RHEL
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
gnutls-utils-debuginfoRocky
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
gnutls-utils-debuginfoRed Hat / RHEL
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.9-9.el10_0.14RHSA-2025:16115
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
Fixed in:0:3.8.3-6.el9_6.2RHSA-2025:16116
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.7.6-21.el9_2.4RHSA-2025:17361
Fixed in:0:3.8.3-4.el9_4.4RHSA-2025:17348
registry.redhat.io/discovery/discoveryRocky
Fixed in:ui-rhel9@sha256:435ba9959b793d46a63a74c343bb8c3ff68350496afec12cc5e894dfc40b7648_arm64RHSA-2025:19088
Fixed in:server-rhel9@sha256:f4f0ef1497a7cde32f6507f6805050a33ecb95b93bb7ad6bd0544edd3ef19af2_arm64RHSA-2025:19088
Fixed in:ui-rhel9@sha256:4784c2680572f9d091fcfb8c593d5424c0fcd8ea9cd51d25ddaf2f72abc7da65_amd64RHSA-2025:19088
Fixed in:server-rhel9@sha256:54d0aab9e86766954949e7a5a11fb29b6b1c463ebb5ba0fb46b2d0f108753208_amd64RHSA-2025:19088
registry.redhat.io/discovery/discoveryRed Hat / RHEL
Fixed in:server-rhel9@sha256:54d0aab9e86766954949e7a5a11fb29b6b1c463ebb5ba0fb46b2d0f108753208_amd64RHSA-2025:19088
Fixed in:server-rhel9@sha256:f4f0ef1497a7cde32f6507f6805050a33ecb95b93bb7ad6bd0544edd3ef19af2_arm64RHSA-2025:19088
Fixed in:ui-rhel9@sha256:4784c2680572f9d091fcfb8c593d5424c0fcd8ea9cd51d25ddaf2f72abc7da65_amd64RHSA-2025:19088
Fixed in:ui-rhel9@sha256:435ba9959b793d46a63a74c343bb8c3ff68350496afec12cc5e894dfc40b7648_arm64RHSA-2025:19088
registry.redhat.io/insights-proxy/insights-proxyRed Hat / RHEL
Fixed in:container-rhel9@sha256:8eb6b896e1eac4080a564e146f95c4166e47ca137083b37119027c6a77011207_arm64RHSA-2025:17181
Fixed in:container-rhel9@sha256:4ca38b33efec0d2dd17a8fd822a7c18281810676ceabb0c1db90953cb91cd5ea_amd64RHSA-2025:17181
registry.redhat.io/insights-proxy/insights-proxyRocky
Fixed in:container-rhel9@sha256:4ca38b33efec0d2dd17a8fd822a7c18281810676ceabb0c1db90953cb91cd5ea_amd64RHSA-2025:17181
Fixed in:container-rhel9@sha256:8eb6b896e1eac4080a564e146f95c4166e47ca137083b37119027c6a77011207_arm64RHSA-2025:17181
registry.redhat.io/rhceph/grafanaRocky
Fixed in:rhel9@sha256:684398687e17d2eff4f713eaee18dea22bbe3285334bfad0d9812fab51c300a8_s390xRHSA-2025:22529
Fixed in:rhel9@sha256:5a9b2a273a676301e4270312e5d03b2b19222d95ee0f95583fd1eedc956078cd_arm64RHSA-2025:22529
Fixed in:rhel9@sha256:d3f279fb0bf1b0e13fce85af7a3976149023cb85faf881bfcf515ae129c3b249_ppc64leRHSA-2025:22529
Fixed in:rhel9@sha256:9394923ea473b90739587a7f90ec269963ec5ce399520d8f626d63ad1357a0a2_amd64RHSA-2025:22529
registry.redhat.io/rhceph/grafanaRed Hat / RHEL
Fixed in:rhel9@sha256:5a9b2a273a676301e4270312e5d03b2b19222d95ee0f95583fd1eedc956078cd_arm64RHSA-2025:22529
Fixed in:rhel9@sha256:d3f279fb0bf1b0e13fce85af7a3976149023cb85faf881bfcf515ae129c3b249_ppc64leRHSA-2025:22529
Fixed in:rhel9@sha256:684398687e17d2eff4f713eaee18dea22bbe3285334bfad0d9812fab51c300a8_s390xRHSA-2025:22529
Fixed in:rhel9@sha256:9394923ea473b90739587a7f90ec269963ec5ce399520d8f626d63ad1357a0a2_amd64RHSA-2025:22529
registry.redhat.io/rhceph/keepalivedRed Hat / RHEL
Fixed in:rhel9@sha256:9fa023730bc77721a1d519ecc1a209b6d4c06b29baa3dcbb5f2dff2921c6cf27_s390xRHSA-2025:22529
Fixed in:rhel9@sha256:721cc49763de142a6eba2dd441ba0dc522500d385d65300219be48d2f31f0c74_ppc64leRHSA-2025:22529
Fixed in:rhel9@sha256:0c2ea384ae2c29dbbc965e9c24f1e6e78d2d1922dae44218c7585030c5a7a906_amd64RHSA-2025:22529
registry.redhat.io/rhceph/keepalivedRocky
Fixed in:rhel9@sha256:721cc49763de142a6eba2dd441ba0dc522500d385d65300219be48d2f31f0c74_ppc64leRHSA-2025:22529
Fixed in:rhel9@sha256:0c2ea384ae2c29dbbc965e9c24f1e6e78d2d1922dae44218c7585030c5a7a906_amd64RHSA-2025:22529
Fixed in:rhel9@sha256:9fa023730bc77721a1d519ecc1a209b6d4c06b29baa3dcbb5f2dff2921c6cf27_s390xRHSA-2025:22529
registry.redhat.io/rhceph/rhcephRed Hat / RHEL
Fixed in:haproxy-rhel9@sha256:2fa401bf3bd53d4f2b9ad775b266ee897206e632a70e7a661409de7860b810c8_ppc64leRHSA-2025:22529
Fixed in:promtail-rhel9@sha256:27ce7c22853f9754b91e91cf9b88f9fb99ceea7b9555724fc36b0dddd83c93a4_ppc64leRHSA-2025:22529
Fixed in:7-rhel9@sha256:ce213d48fbefae6b9d5f5a64b79c6ed016afcb646bf7b5742707ed31f9a464a2_ppc64leRHSA-2025:22529
Fixed in:haproxy-rhel9@sha256:de1c3da36e3258c2b6032bf2e3f89fb2c6018489deab55bf97d2416294e4dcf6_amd64RHSA-2025:22529
Fixed in:promtail-rhel9@sha256:29f771b5f09b0e33d1c2589166a17368f5eec98e46efbe962ecc7a5c8d9ec923_amd64RHSA-2025:22529
Fixed in:7-rhel9@sha256:4d2f9dc5b2b33ee1c77bbfabcbbb9f4d94d343b04c4de2e4f8b3b81a1f0fd2fe_amd64RHSA-2025:22529
Fixed in:haproxy-rhel9@sha256:9b67425fc074cc2154ac38dd8b5e92e5b2bbd46f8899683a23e9020e62ab5adf_s390xRHSA-2025:22529
Fixed in:promtail-rhel9@sha256:6ae4656046c69b9821519e54665d9bc6575f3cf35c3a83fa78b50b7efe95ef53_s390xRHSA-2025:22529
Fixed in:7-rhel9@sha256:6b79ed10423d954d21dd24c9cb1cf507f6e02c2942ace7fa30cf7af2ffaeb631_s390xRHSA-2025:22529
registry.redhat.io/rhceph/rhcephRocky
Fixed in:haproxy-rhel9@sha256:de1c3da36e3258c2b6032bf2e3f89fb2c6018489deab55bf97d2416294e4dcf6_amd64RHSA-2025:22529
Fixed in:promtail-rhel9@sha256:29f771b5f09b0e33d1c2589166a17368f5eec98e46efbe962ecc7a5c8d9ec923_amd64RHSA-2025:22529
Fixed in:7-rhel9@sha256:4d2f9dc5b2b33ee1c77bbfabcbbb9f4d94d343b04c4de2e4f8b3b81a1f0fd2fe_amd64RHSA-2025:22529
Fixed in:haproxy-rhel9@sha256:9b67425fc074cc2154ac38dd8b5e92e5b2bbd46f8899683a23e9020e62ab5adf_s390xRHSA-2025:22529
Fixed in:promtail-rhel9@sha256:6ae4656046c69b9821519e54665d9bc6575f3cf35c3a83fa78b50b7efe95ef53_s390xRHSA-2025:22529
Fixed in:7-rhel9@sha256:6b79ed10423d954d21dd24c9cb1cf507f6e02c2942ace7fa30cf7af2ffaeb631_s390xRHSA-2025:22529
Fixed in:haproxy-rhel9@sha256:2fa401bf3bd53d4f2b9ad775b266ee897206e632a70e7a661409de7860b810c8_ppc64leRHSA-2025:22529
Fixed in:promtail-rhel9@sha256:27ce7c22853f9754b91e91cf9b88f9fb99ceea7b9555724fc36b0dddd83c93a4_ppc64leRHSA-2025:22529
Fixed in:7-rhel9@sha256:ce213d48fbefae6b9d5f5a64b79c6ed016afcb646bf7b5742707ed31f9a464a2_ppc64leRHSA-2025:22529
registry.redhat.io/rhceph/snmpRocky
Fixed in:notifier-rhel9@sha256:992f1649dfed889b9af86da3dcb91a764dc4a0b5918c4ce0945a0c1f5329dfa5_s390xRHSA-2025:22529
Fixed in:notifier-rhel9@sha256:adaa24cdf0a56c1fbda2f7ac7f977b07dfc8c12654cbdc8d9dc5c020b2736056_amd64RHSA-2025:22529
Fixed in:notifier-rhel9@sha256:6968e191b6f06b24febd441bd8b6b2d68236a6cee30a233d1ef6fc1191332204_ppc64leRHSA-2025:22529
registry.redhat.io/rhceph/snmpRed Hat / RHEL
Fixed in:notifier-rhel9@sha256:adaa24cdf0a56c1fbda2f7ac7f977b07dfc8c12654cbdc8d9dc5c020b2736056_amd64RHSA-2025:22529
Fixed in:notifier-rhel9@sha256:992f1649dfed889b9af86da3dcb91a764dc4a0b5918c4ce0945a0c1f5329dfa5_s390xRHSA-2025:22529
Fixed in:notifier-rhel9@sha256:6968e191b6f06b24febd441bd8b6b2d68236a6cee30a233d1ef6fc1191332204_ppc64leRHSA-2025:22529
gnutls28Ubuntu
Fixed in:3.7.3-4ubuntu1.7USN-7635-1
Fixed in:3.8.3-1.1ubuntu3.4USN-7635-1
libgnutls30Ubuntu
Fixed in:3.7.3-4ubuntu1.7USN-7635-1
libgnutls30t64Ubuntu
Fixed in:3.8.3-1.1ubuntu3.4USN-7635-1

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged

Impact

ConfidentialityLow
IntegrityNone
AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploit Intelligence

1.18%probability of exploitation in 30 days
64thpercentile

Moderate risk: more likely to be exploited than 64% of all known CVEs.

References

Vendor Advisory1
Issue Tracking1

Related Vulnerabilities

Other CWE-295 (Improper Certificate Validation) vulnerabilities, ordered by exploit likelihood. View all

CVESeverityCVSSEPSSExploitedFix
CVE-2015-4000Low3.7100%-Fix
CVE-2020-0601High8.189%KEVFix
CVE-2009-3555Critical9.887%-Fix
CVE-2022-26923High8.883%KEVFix
CVE-2023-27823Critical9.853%--
CVE-2022-42979High8.824%--
Embed a live status badge for CVE-2025-32989
CVE-2025-32989 severity badge

Markdown

[![CVE-2025-32989](https://tridentstack.com/cve/badge/CVE-2025-32989.svg)](https://tridentstack.com/cve/CVE-2025-32989)

HTML

<a href="https://tridentstack.com/cve/CVE-2025-32989"><img src="https://tridentstack.com/cve/badge/CVE-2025-32989.svg" alt="CVE-2025-32989"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-06-30.