CVE-2021-4209
MediumCVSS 6.5Exploitation Probability (EPSS)
High risk77th percentile - higher than 77% of all known CVEs
Summary
A NULL pointer dereference flaw was found in GnuTLS. Nettle's hash update functions internally call memcpy, and providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.
Risk Assessment
May cause crashes in applications using GnuTLS, leading to service disruption. Risk is limited as exploitation requires rare conditions.
Recommendation
Update GnuTLS to a version containing the fix. Monitor for errors related to Nettle and GnuTLS.
Other vulnerabilities in GnuTLS
See all- CVE-2016-4456High
The 'GNUTLS_KEYLOGFILE' environment variable in gnutls 3.4.12 allows remote attackers to overwrite and corrupt arbitrary files in the filesystem.
- CVE-2017-7507High
GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. This could lead to a crash of the GnuTLS server application.
- CVE-2017-7869High
GnuTLS before February 20, 2017, has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue is a subset of the vendor's GNUTLS-SA-2017-3 report and is fixed in version 3.5.10.
- CVE-2017-5335High
The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate.
- CVE-2016-7444High
The gnutls_ocsp_resp_check_crt function in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism.
- CVE-2015-3308High
A double free vulnerability in lib/x509/x509_ext.c in GnuTLS before version 3.3.14 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted CRL distribution point.
- CVE-2021-20232Critical
A flaw was found in gnutls. A use-after-free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential consequences.
- CVE-2021-20231Critical
A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences.
- CVE-2020-13777High
GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.
- CVE-2017-5337Critical
Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.
Original NVD description (English source)
A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS