Home

CVE-2020-24659

Description

An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the applications error handling path, where the gnutls_deinit function is called after detecting a handshake failure.

Risk Information

Base Score
7.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
Exploitation Probability
3.396

Associated Vulnerability

VulnerabilityOS Platform
GNU TLS library (USN-4491-1) libgnutls30_3.6.13-2ubuntu1.3_i386.debLinux
GNU TLS library (USN-4491-1) libgnutls30_3.6.13-2ubuntu1.3_amd64.debLinux
(RHSA-2020:5483) gnutls security and bug fix update gnutls-3.6.14-7.el8_3.i686.rpmLinux
(RHSA-2020:5483) gnutls security and bug fix update gnutls-3.6.14-7.el8_3.x86_64.rpmLinux
(RHSA-2020:5483) gnutls security and bug fix update gnutls-c++-3.6.14-7.el8_3.i686.rpmLinux
(RHSA-2020:5483) gnutls security and bug fix update gnutls-c++-3.6.14-7.el8_3.x86_64.rpmLinux
(RHSA-2020:5483) gnutls security and bug fix update gnutls-dane-3.6.14-7.el8_3.i686.rpmLinux
(RHSA-2020:5483) gnutls security and bug fix update gnutls-dane-3.6.14-7.el8_3.x86_64.rpmLinux
(RHSA-2020:5483) gnutls security and bug fix update gnutls-debugsource-3.6.14-7.el8_3.i686.rpmLinux
(RHSA-2020:5483) gnutls security and bug fix update gnutls-debugsource-3.6.14-7.el8_3.x86_64.rpmLinux
(RHSA-2020:5483) gnutls security and bug fix update gnutls-devel-3.6.14-7.el8_3.i686.rpmLinux
(RHSA-2020:5483) gnutls security and bug fix update gnutls-devel-3.6.14-7.el8_3.x86_64.rpmLinux
(RHSA-2020:5483) gnutls security and bug fix update gnutls-utils-3.6.14-7.el8_3.x86_64.rpmLinux
Gnutls update (ELSA-2020-5483) gnutls-3.6.14-7.el8_3.i686.rpmLinux
Gnutls update (ELSA-2020-5483) gnutls-3.6.14-7.el8_3.x86_64.rpmLinux
Gnutls-c++ update (ELSA-2020-5483) gnutls-c++-3.6.14-7.el8_3.i686.rpmLinux
Gnutls-c++ update (ELSA-2020-5483) gnutls-c++-3.6.14-7.el8_3.x86_64.rpmLinux
Gnutls-dane update (ELSA-2020-5483) gnutls-dane-3.6.14-7.el8_3.i686.rpmLinux
Gnutls-dane update (ELSA-2020-5483) gnutls-dane-3.6.14-7.el8_3.x86_64.rpmLinux
Gnutls-devel update (ELSA-2020-5483) gnutls-devel-3.6.14-7.el8_3.i686.rpmLinux
Gnutls-devel update (ELSA-2020-5483) gnutls-devel-3.6.14-7.el8_3.x86_64.rpmLinux
Gnutls-utils update (ELSA-2020-5483) gnutls-utils-3.6.14-7.el8_3.x86_64.rpmLinux
Out-of-bounds Write Vulnerability (CVE-2020-24659)NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234