The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade gnutls-utilsUpgrade gnutlsUpgrade gnutls-c++Upgrade gnutls-develUpgrade gnutls-dane | Dec 1, 2016 | Nov 13, 2014 |
| Debian | — | Upgrade gnutls28 | Jul 30, 2024 | Nov 13, 2014 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Nov 13, 2014 |
| Oracle_linux | — | Upgrade gnutls-develUpgrade gnutls-utilsUpgrade gnutls-daneUpgrade gnutlsUpgrade gnutls-c++ | Oct 16, 2024 | Nov 13, 2014 |
| Suse | — | Upgrade libgnutls28-32bitUpgrade gnutlsUpgrade libgnutls30Upgrade libgnutls30-hmacUpgrade libgnutls-dane0Upgrade libgnutls30-32bitUpgrade libgnutls28Upgrade libgnutls-openssl27Upgrade libgnutls30-hmac-32bitUpgrade libgnutls-develUpgrade libgnutls-openssl-develUpgrade libgnutlsxx-develUpgrade libgnutlsxx28 | Dec 18, 2015 | Nov 13, 2014 |
| Ubuntu | — | Upgrade libgnutls-openssl27Upgrade libgnutlsxx28Upgrade libgnutls-deb0-28Upgrade gnutls-bin | Nov 8, 2024 | Nov 13, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub