Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. In versions prior to 0.12.3 and 0.13.0, code for client certificate verification imported the certi…

Mod_gnutls, a TLS module for Apache HTTPD based on GnuTLS, contains a buffer overflow vulnerability in versions prior to 0.12.3 and 0.13.0. The vulnerability occurs during client certificate verification when the certificate chain is imported into a fixed-size array without proper bounds checking. While no attacker-controlled data is written to the stack buffer, the issue can cause segfaults and potential stack corruption. Only servers using client certificate verification are affected, as the default configuration ignores client certificates. The vulnerability has been fixed in versions 0.12.3 and 0.13.0 with different approaches.