Description
A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
- debian / debian_linux11.0 – 11.0
- fedoraproject / fedora38 – 38
- fedoraproject / fedora39 – 39
- gnu / gnutls3.7.0 – 3.8.3
- NetApp / active_iq_unified_manager
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:0533
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:1082
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:1383
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:2094
- VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2024-0567
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2258544
- MISChttps://gitlab.com/gnutls/gnutls/-/issues/1521
- MAILING_LISThttps://lists.gnupg.org/pipermail/gnutls-help/2024-January/004841.html
Updated 44m ago · 8 sources