CVE-2020-11501

GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '' bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol.

Link	Resource
https://gitlab.com/gnutls/gnutls/-/commit/5b595e8e52653f6c5726a4cdd8fddeb6e83804d2	Patch Third Party Advisory
https://gitlab.com/gnutls/gnutls/-/issues/960	Issue Tracking Patch
https://www.gnutls.org/security-new.html#GNUTLS-SA-2020-03-31	Vendor Advisory
https://www.debian.org/security/2020/dsa-4652	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00015.html	Third Party Advisory
https://security.netapp.com/advisory/ntap-20200416-0002/	Third Party Advisory
https://usn.ubuntu.com/4322-1/	Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WDYY3R4F5CUTFAMXH2C5NKYFVDEJLTT7/	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ/	Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202004-06	Third Party Advisory

Configuration 1

cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

---

Published : 2020-04-03 01:15

Updated : 2021-07-21 11:39

---

NVD link : CVE-2020-11501

Mitre link : CVE-2020-11501

No products.

CWE-330