The _gnutls_recv_client_kx_message function in lib/gnutls_kx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service (NULL dereference and crash) via a TLS message containing multiple Client Hello messages, aka GNUTLS-SA-2008-1-2.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade gnutlsUpgrade gnutls-develUpgrade gnutls-utils | Dec 1, 2016 | May 21, 2008 |
| Gentoo Linux | — | Upgrade net-libs/gnutls. | Oct 30, 2017 | May 21, 2008 |
| Oracle_linux | — | Upgrade gnutlsUpgrade gnutls-develUpgrade gnutls-utils | Oct 16, 2024 | May 21, 2008 |
| Suse | — | Upgrade libgnutls-extra-develUpgrade libgnutlsxx30Upgrade libgnutls-devel-docUpgrade libgnutls26-32bitUpgrade gnutlsUpgrade libgnutls26-x86Upgrade libgnutls26Upgrade libgnutls-develUpgrade libgnutls-extra26Upgrade libgnutls30Upgrade libgnutlsxx-devel | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libgnutls12Upgrade libgnutls13 | Nov 8, 2024 | May 21, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub