GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\0' bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade gnutls | Jun 16, 2020 | Apr 3, 2020 |
| Centos_linux | — | Upgrade gnutls-c++-debuginfoUpgrade gnutlsUpgrade gnutls-develUpgrade gnutls-utils-debuginfoUpgrade gnutls-debuginfoUpgrade gnutls-daneUpgrade gnutls-utilsUpgrade gnutls-c++Upgrade gnutls-debugsourceUpgrade gnutls-dane-debuginfo | May 1, 2020 | Apr 3, 2020 |
| Debian | — | Upgrade gnutls28 | Apr 6, 2020 | Apr 3, 2020 |
| Freebsd | — | Upgrade gnutls | Jun 5, 2020 | Mar 31, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade gnutls-c++Upgrade gnutlsUpgrade gnutls-daneUpgrade gnutls-develUpgrade gnutls-utils | Jul 31, 2020 | Apr 3, 2020 |
| Oracle Solaris | — | Upgrade library/security/nettle to version 3.5.1-11.4.27.0.1.82.0 on Solaris 11.4Upgrade library/gnutls-3 to version 3.6.14-11.4.27.0.1.82.0 on Solaris 11.4 | Jan 19, 2021 | Apr 3, 2020 |
| Oracle_linux | — | Upgrade gnutls-c++Upgrade gnutls-utilsUpgrade gnutls-develUpgrade gnutlsUpgrade gnutls-dane | Oct 5, 2022 | Mar 27, 2020 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Apr 3, 2020 |
| Redhat_linux | — | Upgrade gnutlsUpgrade gnutls-utilsUpgrade gnutls-debugsourceUpgrade gnutls-utils-debuginfoUpgrade gnutls-daneUpgrade gnutls-c++Upgrade gnutls-dane-debuginfoUpgrade gnutls-debuginfoUpgrade gnutls-c++-debuginfoUpgrade gnutls-devel | May 1, 2020 | Apr 3, 2020 |
| Suse | — | Upgrade libgnutls-dane-develUpgrade libnettle-devel-32bitUpgrade gnutls-guileUpgrade libgnutls30Upgrade libnettle6-32bitUpgrade libnettle-develUpgrade gnutlsUpgrade libgmp10Upgrade libgnutls30-32bitUpgrade gmp-develUpgrade libgmpxx4Upgrade libgmp10-32bitUpgrade libgmpxx4-32bitUpgrade libhogweed4-32bitUpgrade libgnutlsxx28Upgrade libgnutlsxx-develUpgrade libnettle6Upgrade nettleUpgrade libgnutls30-hmacUpgrade gmp-devel-32bitUpgrade libgnutls-dane0Upgrade libhogweed4Upgrade libgnutls-develUpgrade libgnutls-devel-32bitUpgrade libgnutls30-hmac-32bit | Apr 9, 2020 | Apr 3, 2020 |
| Ubuntu | — | Upgrade libgnutls30 | Apr 8, 2020 | Apr 3, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 3, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub