An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.

The remote NewStart CGSL host, running version MAIN 6.06, has gnutls packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS     1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second     handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit     function is called after detecting a handshake failure. (CVE-2020-24659)

  - A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to     memory corruption and other consequences. (CVE-2021-20231)

  - A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may     lead to memory corruption and other potential consequences. (CVE-2021-20232)

  - A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during     verification of pkcs7 signatures in gnutls_pkcs7_verify function. (CVE-2022-2509)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2020:2864-2 advisory.

  - An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS     1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second     handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit     function is called after detecting a handshake failure. (CVE-2020-24659)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2020:5483 advisory.

  - An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS     1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second     handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit     function is called after detecting a handshake failure. (CVE-2020-24659)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has gnutls packages installed that are affected by a vulnerability:

  - An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS     1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second     handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit     function is called after detecting a handshake failure. (CVE-2020-24659)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the gnutls packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - An issue was discovered in GnuTLS before 3.6.15. A     server can trigger a NULL pointer dereference in a TLS     1.3 client if a no_renegotiation alert is sent with     unexpected timing, and then an invalid second handshake     occurs. The crash happens in the application's error     handling path, where the gnutls_deinit function is     called after detecting a handshake     failure.(CVE-2020-24659)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:5483 advisory.

  - gnutls: Heap buffer overflow in handshake with no_renegotiation alert sent (CVE-2020-24659)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5483 advisory.

    [3.6.14-7]
    - Increase DH key bits to >= 2048 in self-tests (#1879506)
    - Implement self-tests for KDF and CMAC (#1890870)
    - Fix CVE-2020-24659: heap buffer-overflow when 'no_renegotiation' alert is received (#1873959)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5483 advisory.

  - gnutls: Heap buffer overflow in handshake with no_renegotiation alert sent (CVE-2020-24659)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for gnutls fixes the following issues :

Fix heap buffer overflow in handshake with no_renegotiation alert sent (CVE-2020-24659 bsc#1176181)

FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)

FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)

FIPS: Add TLS KDF selftest (bsc#1176671)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An issue was discovered in GnuTLS before 3.6.15. A     server can trigger a NULL pointer dereference in a TLS     1.3 client if a no_renegotiation alert is sent with     unexpected timing, and then an invalid second handshake     occurs. The crash happens in the application's error     handling path, where the gnutls_deinit function is     called after detecting a handshake     failure.(CVE-2020-24659)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gnutls fixes the following issues :

  - Fix heap buffer overflow in handshake with     no_renegotiation alert sent (CVE-2020-24659 bsc#1176181)

  - FIPS: Implement (EC)DH requirements from SP800-56Arev3     (bsc#1176086)

  - FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)

  - FIPS: Add TLS KDF selftest (bsc#1176671)

This update was imported from the SUSE:SLE-15:Update update project.

An update of the gnutls package has been released.

https://lists.gnupg.org/pipermail/gnutls-help/2020-September/004669.ht ml

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4491-1 advisory.

    It was discovered that GnuTLS incorrectly handled certain alerts when being used with TLS 1.3 servers. A     remote attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or     possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202009-01 (GnuTLS: Denial of service)

    It was found that GnuTLS didn&rsquo;t handle &ldquo;no_renegotiation&rdquo; alert       properly.
  Impact :

    A remote attacker could entice a user to connect to a malicious TLS       endpoint using an application linked against GnuTLS, possibly resulting       in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The GnuTLS project reports :

It was found by oss-fuzz that the server sending a 'no_renegotiation' alert in an unexpected timing, followed by an invalid second handshake can cause a TLS 1.3 client to crash via a NULL pointer dereference.
The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.

ID	Name	Product	Family	Severity
187367	NewStart CGSL MAIN 6.06 : gnutls Multiple Vulnerabilities (NS-SA-2023-0100)	Nessus	NewStart CGSL Local Security Checks	critical
163244	SUSE SLES15 Security Update : gnutls (SUSE-SU-2020:2864-2)	Nessus	SuSE Local Security Checks	high
157700	AlmaLinux 8 : gnutls (ALSA-2020:5483)	Nessus	Alma Linux Local Security Checks	high
147393	NewStart CGSL MAIN 6.02 : gnutls Vulnerability (NS-SA-2021-0074)	Nessus	NewStart CGSL Local Security Checks	high
147082	EulerOS Virtualization for ARM 64 3.0.6.0 : gnutls (EulerOS-SA-2021-1582)	Nessus	Huawei Local Security Checks	high
145817	CentOS 8 : gnutls (CESA-2020:5483)	Nessus	CentOS Local Security Checks	high
144508	Oracle Linux 8 : gnutls (ELSA-2020-5483)	Nessus	Oracle Linux Local Security Checks	high
144393	RHEL 8 : gnutls (RHSA-2020:5483)	Nessus	Red Hat Local Security Checks	high
143866	SUSE SLED15 / SLES15 Security Update : gnutls (SUSE-SU-2020:2864-1)	Nessus	SuSE Local Security Checks	high
143722	SUSE SLED15 / SLES15 Security Update : gnutls (SUSE-SU-2020:2988-1)	Nessus	SuSE Local Security Checks	high
142203	EulerOS 2.0 SP8 : gnutls (EulerOS-SA-2020-2310)	Nessus	Huawei Local Security Checks	high
141924	openSUSE Security Update : gnutls (openSUSE-2020-1743)	Nessus	SuSE Local Security Checks	high
141898	openSUSE Security Update : gnutls (openSUSE-2020-1724)	Nessus	SuSE Local Security Checks	high
141444	Photon OS 2.0: Gnutls PHSA-2020-2.0-0288	Nessus	PhotonOS Local Security Checks	high
141441	Photon OS 1.0: Gnutls PHSA-2020-1.0-0330	Nessus	PhotonOS Local Security Checks	high
141093	Photon OS 3.0: Gnutls PHSA-2020-3.0-0146	Nessus	PhotonOS Local Security Checks	high
140544	Fedora 32 : mingw-gnutls (2020-0ab6656303)	Nessus	Fedora Local Security Checks	high
140458	Ubuntu 20.04 LTS : GnuTLS vulnerability (USN-4491-1)	Nessus	Ubuntu Local Security Checks	high
140315	GLSA-202009-01 : GnuTLS: Denial of service	Nessus	Gentoo Local Security Checks	high
140311	FreeBSD : GnuTLS -- NULL pointer dereference (2272e6f1-f029-11ea-838a-0011d823eebd)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2020-24659

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high