PT-2020-13675 · Gnu+7 · Gnutls+7
Published
2020-06-03
·
Updated
2024-07-04
·
CVE-2020-13777
CVSS v3.1
7.4
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
GnuTLS versions 3.6.4 through 3.6.14
Description
The issue is related to incorrect cryptography used for encrypting a session ticket, leading to a loss of confidentiality in TLS 1.2 and an authentication bypass in TLS 1.3. This allows an attacker to resume a TLS 1.3 session without knowing the master key, enabling man-in-the-middle (MITM) attacks. The earliest affected version is 3.6.4 due to an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.
Recommendations
For GnuTLS versions 3.6.4 through 3.6.14, update to version 3.6.14 or later to resolve the issue. As a temporary workaround, consider restricting access to TLS 1.3 sessions or disabling session resumption until a patch is available. Avoid using the affected GnuTLS library for sensitive transactions until the issue is resolved.
Exploit
Fix
Use of a Broken Cryptographic Algorithm
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Gnutls
Linuxmint
Red Hat
Red Os
Suse
Ubuntu