CVE-2019-3836

Description

It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages.

References

https://usn.ubuntu.com/3999-1/

https://security.netapp.com/advisory/ntap-20190502-0005/

https://security.gentoo.org/glsa/201904-14

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A3ETBUFBB4G7AITAOUYPGXVMBGVXKUAN/

https://gitlab.com/gnutls/gnutls/issues/704

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3836

https://access.redhat.com/errata/RHSA-2019:3600

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00017.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3