CVE-2020-24659

Name
CVE-2020-24659
Description
An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.
NVD Severity
medium
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Exploit https://gitlab.com/gnutls/gnutls/-/issues/1071
Vendor Advisory https://www.gnutls.org/security-new.html#GNUTLS-SA-2020-09-04
Third Party Advisory https://security.gentoo.org/glsa/202009-01
Third Party Advisory https://security.netapp.com/advisory/ntap-20200911-0006/
Third Party Advisory https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62BUAI4FQQLG6VTKRT7SUZPGJJ4NASQ3/
UBUNTU https://usn.ubuntu.com/4491-1/
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AWN56FDLQQXT2D2YHNI4TYH432TDMQ7N/
SUSE http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00054.html
SUSE http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00060.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:* gnutls >= None < 3.6.15

Vulnerable and fixed packages

Source package Branch Version Maintainer Status