Log in Start free

Vulnerability · Published Aug 1, 2022 · Assigned by redhat

CVE-2022-2509

High 7.5

In plain English

A high-severity double free in GnuTLS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.3%top 16.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8gnutls3.6.16-5.el8_6ALSA-2022:7105
AlmaLinux:9gnutls3.7.6-12.el9_0ALSA-2022:6854
AlmaLinux:8gnutls-c++3.6.16-5.el8_6ALSA-2022:7105
AlmaLinux:9gnutls-c++3.7.6-12.el9_0ALSA-2022:6854
AlmaLinux:8gnutls-dane3.6.16-5.el8_6ALSA-2022:7105
AlmaLinux:9gnutls-dane3.7.6-12.el9_0ALSA-2022:6854
AlmaLinux:8gnutls-devel3.6.16-5.el8_6ALSA-2022:7105
AlmaLinux:9gnutls-devel3.7.6-12.el9_0ALSA-2022:6854
AlmaLinux:8gnutls-utils3.6.16-5.el8_6ALSA-2022:7105
AlmaLinux:9gnutls-utils3.7.6-12.el9_0ALSA-2022:6854
Alpine:v3.20gnutls3.7.7-r0ALPINE-CVE-2022-2509
Alpine:v3.21gnutls3.7.7-r0ALPINE-CVE-2022-2509
Alpine:v3.22gnutls3.7.7-r0ALPINE-CVE-2022-2509
Alpine:v3.23gnutls3.7.7-r0ALPINE-CVE-2022-2509
Alpine:v3.24gnutls3.7.7-r0ALPINE-CVE-2022-2509
Debian:12gnutls283.7.7-1DEBIAN-CVE-2022-2509
Debian:13gnutls283.7.7-1DEBIAN-CVE-2022-2509
Debian:14gnutls283.7.7-1DEBIAN-CVE-2022-2509
Rocky Linux:8gnutls0:3.6.16-5.el8_6RLSA-2022:7105
Rocky Linux:9gnutls0:3.7.6-12.el9_0RLSA-2022:6854
Rocky Linux:9nettle0:3.8-3.el9_0RLSA-2022:6854
Ubuntu:22.04:LTSgnutls283.7.3-4ubuntu1.1USN-5550-1
Ubuntu:22.04:LTSgnutls283.7.3-4ubuntu1.1UBUNTU-CVE-2022-2509

Affected products (as reported)

VendorProductVersions
n/a GnuTLS gnutls 3.7.7(Fixed)

Weakness: CWE-415 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References