GnuTLS vulnerabilities

The 'GNUTLS_KEYLOGFILE' environment variable in gnutls 3.4.12 allows remote attackers to overwrite and corrupt arbitrary files in the filesystem.

GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. This could lead to a crash of the GnuTLS server application.

GnuTLS before February 20, 2017, has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue is a subset of the vendor's GNUTLS-SA-2017-3 report and is fixed in version 3.5.10.

The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate.

The gnutls_ocsp_resp_check_crt function in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism.

A double free vulnerability in lib/x509/x509_ext.c in GnuTLS before version 3.3.14 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted CRL distribution point.

A flaw was found in GnuTLS related to the Minerva attack, a cryptographic vulnerability that exploits deterministic behavior, leading to side-channel leaks. In specific scenarios, such as using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce values.

Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.

A stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.

A double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.

In GnuTLS, the `gnutls_pkcs11_token_set_pin` function can lead to a use-after-free vulnerability when changing the Security Officer PIN with a NULL old PIN for a token without a protected authentication path.

A flaw was found in gnutls where the PKCS#7 padding check during decryption was not constant-time. This timing side-channel could allow a remote attacker to leak sensitive information about padding bytes. This is a form of information disclosure.

An off-by-one error in gnutls in PKCS#12 bag element bounds check. A remote attacker can write past the internal array when the bag already contains 32 elements, causing memory corruption and potential DoS.

Flaw in gnutls certificate validation. An oversized Subject Alternative Name (SAN) can cause incorrect fallback to Common Name (CN) check, allowing a remote attacker to bypass certificate validation and perform spoofing or man-in-the-middle attacks.

A flaw in gnutls allows a remote attacker to present a specially crafted certificate with URI or SRV SANs, potentially causing incorrect hostname validation against CN and enabling service spoofing or data interception.

A flaw was found in GnuTLS in the DTLS packet reordering logic. The comparator function does not correctly handle packets with duplicate sequence numbers, leading to unstable ordering or undefined behavior, resulting in a denial of service.

A flaw in gnutls causes permitted name constraints to be incorrectly ignored when previous CAs only had excluded name constraints. A remote attacker can bypass critical name constraint checks during certificate validation.

A flaw in GnuTLS causes servers configured with RSA-PSK to incorrectly match usernames containing a NUL character with truncated usernames. A remote attacker can bypass authentication by sending a crafted username.

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing an out-of-bounds write on the heap.

GnuTLS performs case-sensitive comparisons of nameConstraints labels, allowing a remote attacker to bypass policy by crafting a certificate with casing differences in the Subject Alternative Name.

A logic flaw was found in GnuTLS when processing multi-record OCSP responses. A remote attacker can exploit this during a TLS handshake by sending a crafted OCSP response, causing a client with OCSP verification enabled to incorrectly accept a revoked server certificate.

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.

A flaw in GnuTLS allows a remote, unauthenticated attacker to send a crafted ClientHello message with an invalid PSK binder value during the TLS handshake, causing a NULL pointer dereference and server crash, leading to a remote Denial of Service (DoS).

A flaw in GnuTLS allows a denial of service (DoS) attack via specially crafted certificates with a large number of name constraints and subject alternative names (SANs), causing excessive CPU and memory consumption.

A flaw was found in the GnuTLS library in the gnutls_pkcs11_token_init() function handling PKCS#11 token initialization. Processing a token label longer than expected causes a stack buffer overflow, potentially leading to application crashes or code execution.

A NULL pointer dereference flaw was found in the GnuTLS library in the _gnutls_figure_common_ciphersuite() function.

A heap-buffer-overflow (off-by-one) vulnerability was found in the GnuTLS software in the template parsing logic of the certtool utility. An attacker can exploit this to cause an out-of-bounds NULL pointer write, leading to memory corruption and a denial-of-service (DoS) that could crash the system.

A heap-buffer-overread vulnerability was found in GnuTLS when handling the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows an attacker to create a certificate with a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that may contain sensitive data. As a result, confidential information may be exposed when GnuTLS verifies certificates from certain websites if the SCT is not checked correctly.

A double-free vulnerability was found in GnuTLS in the export logic of Subject Alternative Name (SAN) entries containing an otherName. The flaw is due to incorrect ownership handling of ASN.1 nodes, leading to a double-free condition when the parent function later attempts to free the same structure.

A flaw in GnuTLS can cause an application crash when verifying a specially crafted .pem bundle using the 'certtool --verify-chain' command.