The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade gnutlsUpgrade gnutls-utilsUpgrade gnutls-develUpgrade gnutls-daneUpgrade gnutls-c++ | Dec 1, 2016 | Nov 13, 2014 |
| Debian | — | Upgrade gnutls28 | Jul 30, 2024 | Nov 13, 2014 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Nov 13, 2014 |
| Oracle_linux | — | Upgrade gnutls-develUpgrade gnutlsUpgrade gnutls-c++Upgrade gnutls-daneUpgrade gnutls-utils | Oct 16, 2024 | Nov 13, 2014 |
| Suse | — | Upgrade libgnutls-openssl27Upgrade libgnutls28Upgrade libgnutls-develUpgrade libgnutls30-hmac-32bitUpgrade libgnutlsxx-develUpgrade libgnutls-openssl-develUpgrade libgnutlsxx28Upgrade libgnutls28-32bitUpgrade libgnutls-dane0Upgrade libgnutls30-32bitUpgrade gnutlsUpgrade libgnutls30-hmacUpgrade libgnutls30 | Dec 18, 2015 | Nov 13, 2014 |
| Ubuntu | — | Upgrade gnutls-binUpgrade libgnutls-deb0-28Upgrade libgnutlsxx28Upgrade libgnutls-openssl27 | Nov 8, 2024 | Nov 13, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub