PT-2021-5761 · Gnutls+10 · Gnutls+10

Shashank Jain · Published 2021-01-22 · Updated 2024-07-17 · CVE-2021-20231

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GnuTLS (affected versions not specified)

Description The issue is related to a use after free problem in the client sending key share extension, which may lead to memory corruption and other consequences, potentially allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2021:4451

ALT-PU-2021-1535

ALT-PU-2021-1545

ALT-PU-2021-1785

ALT-PU-2022-2183

AZL-6446

BDU:2022-00206

CESA-2021_4451

CVE-2021-20231

MGASA-2021-0291

OESA-2021-1109

OPENSUSE-SU-2021:0470-1

OPENSUSE-SU-2021_0470-1

RHSA-2021:4451

RHSA-2021_4451

RLSA-2021:4451

SUSE-SU-2021:0934-1

SUSE-SU-2021:0935-1

SUSE-SU-2021_0934-1

SUSE-SU-2021_0935-1

USN-5029-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Gnutls

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 73

• 🔥 https://gnutls.org/security-new.html#GNUTLS-SA-2021-03-10 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OSLAE6PP33A7VYRYMYMUVB3U6B26GZER · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:4451 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1922276 · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/OSLAE6PP33A7VYRYMYMUVB3U6B26GZER · Vendor Advisory
• https://osv.dev/vulnerability/AZL-6446 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00206 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:0935-1 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2021-4451.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-20231 · Security Note
• https://ubuntu.com/security/notices/USN-5029-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20232 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20231 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0470-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0114SE47 · Vendor Advisory