The _gnutls_recv_client_kx_message function in lib/gnutls_kx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service (NULL dereference and crash) via a TLS message containing multiple Client Hello messages, aka GNUTLS-SA-2008-1-2.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade gnutls-utilsUpgrade gnutlsUpgrade gnutls-devel | Dec 1, 2016 | May 21, 2008 |
| Gentoo Linux | — | Upgrade net-libs/gnutls. | Oct 30, 2017 | May 21, 2008 |
| Oracle_linux | — | Upgrade gnutls-utilsUpgrade gnutlsUpgrade gnutls-devel | Oct 16, 2024 | May 21, 2008 |
| Suse | — | Upgrade gnutlsUpgrade libgnutls-devel-docUpgrade libgnutlsxx30Upgrade libgnutls26-x86Upgrade libgnutls26-32bitUpgrade libgnutls-extra-develUpgrade libgnutls-develUpgrade libgnutls-extra26Upgrade libgnutls26Upgrade libgnutlsxx-develUpgrade libgnutls30 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libgnutls13Upgrade libgnutls12 | Nov 8, 2024 | May 21, 2008 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub