It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0008 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-3829:
    A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free)     vulnerability in the certificate verification API. Any client or server application that verifies X.509     certificates with GnuTLS 3.5.8 or later is affected.

    CVE-2019-3836:
    It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in     gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages.

    CVE-2020-11501:
    GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3     (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\0' bytes instead     of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security     guarantees of the DTLS protocol.

    CVE-2020-13777:
    GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of     confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is     3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS     server always uses wrong data in place of an encryption key derived from an application.

    CVE-2020-24659:
    An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS     1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second     handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit     function is called after detecting a handshake failure.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the gnutls package has been released.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3600 advisory.

    - Fixed CVE-2019-3829 (#1693285)
    - Fixed CVE-2019-3836 (#1693288)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3600 advisory.

  - gnutls: use-after-free/double-free in certificate verification (CVE-2019-3829)

  - gnutls: invalid pointer access upon receiving async handshake messages (CVE-2019-3836)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the gnutls packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in gnutls versions from 3.5.8     before 3.6.7. A memory corruption (double free)     vulnerability in the certificate verification API. Any     client or server application that verifies X.509     certificates with GnuTLS 3.5.8 or later is     affected.(CVE-2019-3829)

  - It was discovered in gnutls before version 3.6.7     upstream that there is an uninitialized pointer access     in gnutls versions 3.6.3 or later which can be     triggered by certain post-handshake     messages.(CVE-2019-3836)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3600 advisory.

    The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements     cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

    The following packages have been upgraded to a later upstream version: gnutls (3.6.8). (BZ#1689967)

    Security Fix(es):

    * gnutls: use-after-free/double-free in certificate verification (CVE-2019-3829)

    * gnutls: invalid pointer access upon receiving async handshake messages (CVE-2019-3836)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way gnutls handled malformed     TLS 1.3 asynchronous messages. An attacker could use     this flaw to crash an application compiled with gnutls     via invalid pointer access.NOTE: The gnutls versions     3.6.4 or later are affected by this     issue.(CVE-2019-3836)

  - A double free flaw was found in the way the certificate     verification API was implemented for gnutls. An     attacker could cause a client or server application     compiled against gnutls to crash by parsing a     specially-crafted certificate.(CVE-2019-3829)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3999-1 advisory.

    Eyal Ronen, Kenneth G. Paterson, and Adi Shamir discovered that GnuTLS was vulnerable to a timing side-     channel attack known as the Lucky Thirteen issue. A remote attacker could possibly use this issue to     perform plaintext-recovery attacks via analysis of timing data. This issue only affected Ubuntu 16.04 LTS     and Ubuntu 18.04 LTS. (CVE-2018-10844, CVE-2018-10845, CVE-2018-10846)

    Tavis Ormandy discovered that GnuTLS incorrectly handled memory when verifying certain X.509 certificates.
    A remote attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or     possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 18.10, and Ubuntu     19.04. (CVE-2019-3829)

    It was discovered that GnuTLS incorrectly handled certain post-handshake messages. A remote attacker could     use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only affected Ubuntu 18.10 and Ubuntu 19.04. (CVE-2019-3836)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for gnutls fixes to version 3.6.7 the following issues :

Security issued fixed :

  - CVE-2019-3836: Fixed an invalid pointer access via     malformed TLS1.3 async messages (bsc#1130682).

  - CVE-2019-3829: Fixed a double free vulnerability in the     certificate verification API (bsc#1130681).

  - CVE-2018-16868: Fixed Bleichenbacher-like side channel     leakage in PKCS#1 v1.5 verification and padding oracle     verification (bsc#1118087)

Non-security issue fixed :

  - Update gnutls to support TLS 1.3 (fate#327114) 

This update was imported from the SUSE:SLE-15:Update update project.

Update to upstream release 3.6.7

Security fix for CVE-2019-3836 and CVE-2019-3829

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gnutls fixes to version 3.6.7 the following issues :

Security issued fixed :

CVE-2019-3836: Fixed an invalid pointer access via malformed TLS1.3 async messages (bsc#1130682).

CVE-2019-3829: Fixed a double free vulnerability in the certificate verification API (bsc#1130681).

CVE-2018-16868: Fixed Bleichenbacher-like side channel leakage in PKCS#1 v1.5 verification and padding oracle verification (bsc#1118087)

Non-security issue fixed: Update gnutls to support TLS 1.3 (fate#327114)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The GnuTLS project reports :

- Tavis Ormandy from Google Project Zero found a memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected.

- It was found using the TLS fuzzer tools that decoding a malformed TLS1.3 asynchronous message can cause a server crash via an invalid pointer access. The issue affects GnuTLS server applications since 3.6.4.

The remote host is affected by the vulnerability described in GLSA-201904-14 (GnuTLS: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GnuTLS. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the CVE identifiers referenced below for details.
  Workaround :

    There is no known workaround at this time.

Security fix for CVE-2019-3829 and CVE-2019-3836

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
236485	Alibaba Cloud Linux 3 : 0008: gnutls (ALINUX3-SA-2021:0008)	Nessus	Alibaba Cloud Linux Local Security Checks	high
202815	Photon OS 3.0: Gnutls PHSA-2019-3.0-0011	Nessus	PhotonOS Local Security Checks	high
180663	Oracle Linux 8 : gnutls (ELSA-2019-3600)	Nessus	Oracle Linux Local Security Checks	high
145666	CentOS 8 : gnutls (CESA-2019:3600)	Nessus	CentOS Local Security Checks	high
131489	EulerOS Virtualization for ARM 64 3.0.3.0 : gnutls (EulerOS-SA-2019-2324)	Nessus	Huawei Local Security Checks	high
130558	RHEL 8 : gnutls (RHSA-2019:3600)	Nessus	Red Hat Local Security Checks	high
126276	EulerOS 2.0 SP8 : gnutls (EulerOS-SA-2019-1649)	Nessus	Huawei Local Security Checks	high
125622	Ubuntu 16.04 LTS / 18.04 LTS : GnuTLS vulnerabilities (USN-3999-1)	Nessus	Ubuntu Local Security Checks	medium
124714	openSUSE Security Update : gnutls (openSUSE-2019-1353)	Nessus	SuSE Local Security Checks	medium
124519	Fedora 30 : gnutls (2019-971ded6f90)	Nessus	Fedora Local Security Checks	high
124454	SUSE SLED15 / SLES15 Security Update : gnutls (SUSE-SU-2019:1121-1)	Nessus	SuSE Local Security Checks	medium
124210	FreeBSD : GnuTLS -- double free, invalid pointer access (fb30db8f-62af-11e9-b0de-001cc0382b2f)	Nessus	FreeBSD Local Security Checks	high
124070	GLSA-201904-14 : GnuTLS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
123761	Fedora 28 : gnutls (2019-46df367eed)	Nessus	Fedora Local Security Checks	high
123538	Fedora 29 : gnutls (2019-e8c1cf958f)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2019-3836

high

Tenable Plugins

high

high

high

high

high

high

high

medium

medium

high

medium

high

high

high

high