CVE-2020-11501
Severity
7.4HIGH
EPSS
11.5%
top 6.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 3
Latest updateMay 24
Description
GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\0' bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 2.2 | Impact: 5.2
Affected Packages3 packages
Also affects: Debian Linux 10.0, Fedora 31, 32, Ubuntu Linux 19.10
Patches
🔴Vulnerability Details
3📋Vendor Advisories
4Microsoft▶
GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\0' byt↗2020-04-14
Debian▶
CVE-2020-11501: gnutls28 - GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest af...↗2020