CVE-2020-11501
CVE-2020-11501
This page contains facts from public vulnerability sources. Check the original advisory before updating.
GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\0' bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol.
EPSS 3.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
Original sources
- https://security.gentoo.org/glsa/202004-06
- https://gitlab.com/gnutls/gnutls/-/issues/960
- https://gitlab.com/gnutls/gnutls/-/commit/5b595e8e52653f6c5726a4cdd8fddeb6e83804d2
- https://www.gnutls.org/security-new.html#GNUTLS-SA-2020-03-31
- https://www.debian.org/security/2020/dsa-4652
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00015.html
- https://security.netapp.com/advisory/ntap-20200416-0002/
- https://usn.ubuntu.com/4322-1/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDYY3R4F5CUTFAMXH2C5NKYFVDEJLTT7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ/
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-11501