CVE-2014-8155 (Other, published 2015-08-14T18:59Z)
Description: value: GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is (1) not yet valid or (2) no longer valid.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-17 \u2014 DEPRECATED: Code
This entry has been deprecated.  It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
Repository: https://gitlab.com/gnutls/gnutls
Files changed:
NEWS
lib/includes/gnutls/x509.h
lib/x509/verify.c
Commit message: Extended time verification to trusted certificate list as well. Introduced
the flag GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS that will prevent the
trusted certificate list verification.


Vulnerable code:
      GNUTLS_VERIFY_DISABLE_TIME_CHECKS = 64
					unsigned int *output);
 * procedure.
			     unsigned int *output)
  gnutls_x509_crt_t issuer;
				     trusted_cas, tcas_size, flags, &output);
      time_t t, now = time (0);
	  t = gnutls_x509_crt_get_activation_time (certificate_list[i]);
	  if (t == (time_t) - 1 || now < t)
	    {
	      status |= GNUTLS_CERT_NOT_ACTIVATED;
	      status |= GNUTLS_CERT_INVALID;
	      return status;
	    }

	  t = gnutls_x509_crt_get_expiration_time (certificate_list[i]);
	  if (t == (time_t) - 1 || now > t)
	      status |= GNUTLS_CERT_EXPIRED;
	      status |= GNUTLS_CERT_INVALID;
					NULL)) == 0)
				 verify);

Fixed code:
** libgnutls: Time verification extended to trusted certificate list,
unless GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS flag is specified.

 * @GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS: If set a signer in the trusted
 *   list is never checked for expiration or activation.
      GNUTLS_VERIFY_DISABLE_TIME_CHECKS = 64,
      GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS = 128,
					unsigned int *output, gnutls_x509_crt_t* issuer);
 * procedure. Issuer will hold the actual issuer from the trusted list.
			     unsigned int *output, gnutls_x509_crt_t *_issuer)
  gnutls_x509_crt_t issuer = NULL;
  if (_issuer != NULL) *_issuer = issuer;

static unsigned int check_time(gnutls_x509_crt_t crt, time_t now)
{
int status = 0;
time_t t;

  t = gnutls_x509_crt_get_activation_time (crt);
  if (t == (time_t) - 1 || now < t)
    {
      status |= GNUTLS_CERT_NOT_ACTIVATED;
      status |= GNUTLS_CERT_INVALID;
      return status;
    }

  t = gnutls_x509_crt_get_expiration_time (crt);
  if (t == (time_t) - 1 || now > t)
    {
      status |= GNUTLS_CERT_EXPIRED;
      status |= GNUTLS_CERT_INVALID;
      return status;
    }
  
  return 0;
}
  time_t now = time (0);
  gnutls_x509_crt_t issuer = NULL;
		  /* explicity time check for trusted CA that we remove from
		   * list. GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS
		   */
		  if (!(flags&GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS) && !(flags&GNUTLS_VERIFY_DISABLE_TIME_CHECKS))
		    {
		      status |= check_time(trusted_cas[j], now);
		      if (status != 0)
		        {
		          return status;
                        }
		    }
				     trusted_cas, tcas_size, flags, &output, &issuer);

      /* check the time of the issuer first */
      if (!(flags&GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS))
        {
          if (issuer == NULL)
            {
              gnutls_assert();
              return GNUTLS_E_INTERNAL_ERROR;
            }

          status |= check_time(issuer, now);
          if (status != 0)
            {
              return status;
            }
        }
	  status |= check_time(certificate_list[i], now);
	  if (status != 0)
					NULL, NULL)) == 0)
				 verify, NULL);