CVE-2025-32989 — Gnutls: vulnerability in gnutls sct extension parsing

Description (CNA)

A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly.

Affected (CNA)

Vendor / product	Versions
Not supplied / Not supplied	affected 0 before 3.8.10
Red Hat / Red Hat Enterprise Linux 10	unaffected 0:3.8.9-9.el10_0.14 before *
Red Hat / Red Hat Enterprise Linux 9	unaffected 0:3.8.3-6.el9_6.2 before *
Red Hat / Red Hat Enterprise Linux 9	unaffected 0:3.8.3-6.el9_6.2 before *
Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	unaffected 0:3.7.6-21.el9_2.4 before *
Red Hat / Red Hat Enterprise Linux 9.4 Extended Update Support	unaffected 0:3.8.3-4.el9_4.4 before *
Red Hat / Red Hat Ceph Storage 7	unaffected 7 before *
Red Hat / Red Hat Discovery 2	unaffected 2.3.0-1760554384 before *
Red Hat / Red Hat Hardened Images	unaffected 3.8.12-1.1.hum1 before *
Red Hat / Red Hat Insights proxy 1.5	unaffected 1.5.7-1759331989 before *
Red Hat / Red Hat Enterprise Linux 6	unknown
Red Hat / Red Hat Enterprise Linux 7	unknown
Red Hat / Red Hat Enterprise Linux 8	unaffected
Red Hat / Red Hat OpenShift Container Platform 4	affected
Red Hat / Red Hat OpenShift Container Platform 4	affected

CWE

CWE-295

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2025/07/11/3

siemens-SADP

No English description supplied.

https://cert-portal.siemens.com/productcert/html/ssa-082556.html