PT-2019-6091 · Gnu+5 · Gnutls+5

Tavis Ormandy

·

Publicado

2019-03-27

·

Atualizado

2024-06-15

·

CVE-2019-3829

CVSS v3.1

7.5

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions GnuTLS versions 3.5.8 through 3.6.7
Description The issue is related to a memory corruption vulnerability, specifically a double free error, in the certificate verification API of the GnuTLS cryptographic library. This could allow a remote attacker to cause a denial of service. Any client or server application that verifies X.509 certificates using the affected GnuTLS versions is impacted.
Recommendations For versions 3.5.8 through 3.6.7, update to version 3.6.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the certificate verification API until a patch is available.

Exploit

Correção

Use After Free

Double Free

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-416CWE-415

Identificadores relacionados

ALT-PU-2019-1542
BDU:2021-05201
CESA-2019_3600
CVE-2019-3829
MGASA-2019-0134
OPENSUSE-SU-2019:1353-1
OPENSUSE-SU-2019_1353-1
OPENSUSE-SU-2024:10801-1
RHSA-2019:3600
RHSA-2019_3600
SUSE-SU-2019:1121-1
USN-3999-1

Produtos afetados

Alt Linux
Centos
Gnutls
Red Hat
Suse
Ubuntu