CVE-2020-24659
04.09.2020, 15:15
An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| gnu | gnutls | 𝑥 < 3.6.15 |
| opensuse | leap | 15.1 |
| opensuse | leap | 15.2 |
| canonical | ubuntu_linux | 20.04 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| gnutls |
| ||||||||||||||||||||||||||||||||
| libgnutls-devel |
| ||||||||||||||||||||||||||||||||
| libgnutls30 |
| ||||||||||||||||||||||||||||||||
| libgnutls30-32bit |
| ||||||||||||||||||||||||||||||||
| libgnutls30-hmac |
| ||||||||||||||||||||||||||||||||
| libgnutls30-hmac-32bit |
| ||||||||||||||||||||||||||||||||
| libgnutlsxx-devel |
| ||||||||||||||||||||||||||||||||
| libgnutlsxx28 |
|
Red Hat Enterprise Linux Releases
Common Weakness Enumeration
References