Detections
Analytics
CVE-2020-13777
high
Description
GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.
References
https://www.debian.org/security/2020/dsa-4697
https://usn.ubuntu.com/4384-1/
https://security.netapp.com/advisory/ntap-20200619-0004/
https://security.gentoo.org/glsa/202006-01
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00015.html
https://github.com/madhunicabala/CVE-Vulnerability-Scanner
https://github.com/shigeki/challenge_CVE-2020-13777
https://github.com/0xxon/cve-2020-13777
https://gnutls.org/security-new.html#GNUTLS-SA-2020-06-03
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-5994
https://cert-portal.siemens.com/productcert/html/ssa-398330.html