A heap-buffer-overflow

GnuTLS ships certtool, a command-line utility administrators use to generate CSRs, self-signed certs, and private keys from human-editable template files. The bug is a classic off-by-one heap overflow (CWE-122) in the template parser: crafted input in a template can overrun a heap buffer by a single byte during processing. Affected versions are GnuTLS prior to 3.8.7 across the 3.7.x and 3.8.x lines; distro-backported fixes landed for RHEL 8/9, Debian bookworm, Ubuntu 22.04/24.04, and SUSE in the weeks following disclosure. The *library* side (libgnutls) — which is what web servers, VPNs, and email daemons actually link — is not affected; the flaw lives in the certtool binary's template code path only.

The vendor score of 6.5 MEDIUM with vector AV:N/AC:L/PR:N/UI:N is misleading. AV:N here is a scoring artifact: it implies remote reachability, but the only way this triggers is if someone runs certtool --generate-request --template <attacker-file> against a file they don't control. That is not a network vulnerability in any operational sense. Confidentiality impact is None, integrity and availability are Low, and there is no path to code execution demonstrated. Real-world severity is LOW — this is a hygiene patch, not a fire.

Why this verdict

• Attack vector is Local, not Network. The CVSS AV:N is inherited from GnuTLS's general threat model; the actual trigger requires feeding certtool a file. Compounding downward pressure #1.
• No service surface. certtool is not a daemon, not a listener, not spawned by any listening process. EDR won't see baseline invocations. Compounding downward pressure #2.
• Impact ceiling is DoS + narrow integrity. CVSS C:N/I:L/A:L — no code execution demonstrated, no privilege change, no lateral movement primitive. Compounding downward pressure #3.
• Role multiplier — typical role (admin workstation / CA operator laptop): chain succeeds only insofar as certtool crashes; blast radius = one shell session. No fleet impact.
• Role multiplier — high-value role (internal PKI / ADCS-equivalent operators): even here, the artifact is reviewed before being loaded into a trust store; the chain does not reach domain or fleet compromise. Floor does not lift above LOW.
• Role multiplier — CI/CD pipelines using certtool: template files are change-controlled in git; delivering a malicious template requires PR merge access, at which point the attacker already has more direct paths.
• libgnutls is not affected — the internet-facing daemons that matter (TLS termination, VPN, mail) are not exposed via this code path. Installed-base share of certtool being run against untrusted input is well under 1%.

Why not higher?

MEDIUM would require a plausible path to code execution or a service-side exposure. Neither exists: it's an off-by-one in an interactive CLI with hardened distro toolchains, and no researcher has demonstrated control-flow hijack in 12+ months since disclosure. HIGH would require a role multiplier landing in a domain-scale blast radius, which the certtool workflow does not provide.

Why not lower?

IGNORE is off the table because the flaw is real, upstream shipped a fix, and there is a non-zero (if contrived) integrity path via corrupted CSRs entering a CA workflow. It stays in the patch backlog under normal hygiene cadence rather than being fully waived.

1. Roll GnuTLS to 3.8.7 (or distro backport) during the next regular patch window — No mitigation SLA applies at LOW — fold this into standard OS-package hygiene and land within the noisgate remediation window of 365 days. On RHEL/Ubuntu, dnf update gnutls-utils / apt install gnutls-bin is sufficient — no service restart required because the flaw is in the utility binary, not the library.
2. Restrict who can drop files into certtool template directories — If you have automation that invokes certtool from a shared path, tighten filesystem ACLs so only trusted operators/service accounts can write templates. Kills the delivery step regardless of patch state.
3. Move CSR generation to reviewed pipelines — Templates consumed by CI/CD should live in a git repo with mandatory PR review and signed commits. This makes a malicious template functionally equivalent to a malicious code commit — same review gate applies.
4. Alert on interactive certtool invocations outside expected admin sessions — EDR process-creation rule: certtool --generate-* from a non-admin user or from a service account with no historical baseline. Low noise, high signal because certtool has very few legitimate callers.

Run this on each Linux host that ships GnuTLS utilities (the gnutls-utils / gnutls-bin package). Invoke as ./check-cve-2025-32990.sh — no root required, it only reads package metadata. Outputs VULNERABLE, PATCHED, or UNKNOWN with an exit code (0/1/2).

#!/usr/bin/env bash
# noisgate check for CVE-2025-32990 (GnuTLS certtool off-by-one)
# Compares the installed gnutls-utils / gnutls-bin version against upstream 3.8.7
# and against known distro backports.
set -u

MIN_UPSTREAM="3.8.7"

ver_ge() {
  # returns 0 if $1 >= $2 (semver-ish)
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

if ! command -v certtool >/dev/null 2>&1; then
  echo "UNKNOWN: certtool not installed on this host"
  exit 2
fi

RAW="$(certtool --version 2>/dev/null | head -n1)"
VER="$(echo "$RAW" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)"

if [ -z "$VER" ]; then
  echo "UNKNOWN: could not parse certtool version from: $RAW"
  exit 2
fi

# Check distro-backport package versions where the upstream number is <3.8.7
# but the security fix is present.
PKG_VER=""
if command -v rpm >/dev/null 2>&1; then
  PKG_VER="$(rpm -q --qf '%{VERSION}-%{RELEASE}\n' gnutls-utils 2>/dev/null | head -n1)"
elif command -v dpkg-query >/dev/null 2>&1; then
  PKG_VER="$(dpkg-query -W -f='${Version}\n' gnutls-bin 2>/dev/null | head -n1)"
fi

echo "certtool binary version: $VER"
echo "distro package version : ${PKG_VER:-n/a}"

# Known-good distro package versions (add as your fleet requires)
case "$PKG_VER" in
  3.6.16-8.el8_10*|3.7.6-24.el9_5*|3.7.9-2+deb12u4*|3.8.3-1.1ubuntu3.3*)
    echo "PATCHED: distro backport detected"
    exit 0
    ;;
esac

if ver_ge "$VER" "$MIN_UPSTREAM"; then
  echo "PATCHED: upstream >= $MIN_UPSTREAM"
  exit 0
fi

echo "VULNERABLE: certtool $VER < $MIN_UPSTREAM and no known backport matched"
exit 1

Sources

1. NVD — CVE-2025-32990
2. Red Hat Security Advisory / Bugzilla
3. GnuTLS upstream release notes 3.8.7
4. Debian security tracker
5. Ubuntu CVE database
6. SUSE CVE database
7. FIRST EPSS lookup
8. MITRE CWE-122: Heap Buffer Overflow