Log in Start free

Vulnerability · Published Sep 4, 2020 · Assigned by mitre

CVE-2020-24659

High 7.5

In plain English

A high-severity security flaw in the gnutls package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.8% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)3.8%top 9.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20gnutls3.6.15-r0ALPINE-CVE-2020-24659
Alpine:v3.21gnutls3.6.15-r0ALPINE-CVE-2020-24659
Alpine:v3.22gnutls3.6.15-r0ALPINE-CVE-2020-24659
Alpine:v3.23gnutls3.6.15-r0ALPINE-CVE-2020-24659
Alpine:v3.24gnutls3.6.15-r0ALPINE-CVE-2020-24659
Debian:12gnutls283.6.15-1DEBIAN-CVE-2020-24659
Debian:13gnutls283.6.15-1DEBIAN-CVE-2020-24659
Debian:14gnutls283.6.15-1DEBIAN-CVE-2020-24659

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References