A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential consequences.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0181 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-20231:
    A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to     memory corruption and other consequences.

    CVE-2021-20232:
    A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may     lead to memory corruption and other potential consequences.

    CVE-2022-2509:
    A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during     verification of pkcs7 signatures in gnutls_pkcs7_verify function.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has gnutls packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS     1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second     handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit     function is called after detecting a handshake failure. (CVE-2020-24659)

  - A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to     memory corruption and other consequences. (CVE-2021-20231)

  - A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may     lead to memory corruption and other potential consequences. (CVE-2021-20232)

  - A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during     verification of pkcs7 signatures in gnutls_pkcs7_verify function. (CVE-2022-2509)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has nettle packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to     memory corruption and other consequences. (CVE-2021-20231)

  - A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may     lead to memory corruption and other potential consequences. (CVE-2021-20232)

  - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An     attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial     of service. (CVE-2021-3580)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has gnutls packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to     memory corruption and other consequences. (CVE-2021-20231)

  - A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may     lead to memory corruption and other potential consequences. (CVE-2021-20232)

  - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An     attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial     of service. (CVE-2021-3580)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:4451 advisory.

  - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An     attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial     of service. (CVE-2021-3580)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9221 advisory.

    [3.6.16-4.0.1_fips]
    - Allow RSA keygen with modulus sizes bigger than 3072 bits and validate the seed length       as defined in FIPS 186-4 section B.3.2 [Orabug: 33200526]
    - Allow bigger known RSA modulus sizes when calling       rsa_generate_fips186_4_keypair directly [Orabug: 33200526]
    - Change Epoch from 1 to 10

    [3.6.16-4]
    - p11tool: Document ID reuse behavior when importing certs (#1776250)

    [3.6.16-3]
    - Treat SHA-1 signed CA in the trusted set differently (#1965445)

    [3.6.16-2]
    - Filter certificate_types in TLS 1.2 CR based on signature algorithms (#1942216)

    [3.6.16-1]
    - Update to upstream 3.6.16 release (#1956783)
    - Fix potential use-after-free in key_share handling (#1927597)
    - Fix potential use-after-free in pre_shared_key handling (#1927593)
    - Stop gnutls-serv relying on AI_ADDRCONFIG to decide listening address (#1908334)
    - Fix cert expiration issue in tests (#1908110)

    [3.6.14-10]
    - Port fixes for potential miscalculation in ecdsa_verify (#1942931)

    [3.6.14-9]
    - Revert the previous change

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the gnutls packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to     memory corruption and other consequences. (CVE-2021-20231)

  - A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may     lead to memory corruption and other potential consequences. (CVE-2021-20232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4451 advisory.

  - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An     attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial     of service. (CVE-2021-3580)

  - A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to     memory corruption and other consequences. (CVE-2021-20231)

  - A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may     lead to memory corruption and other potential consequences. (CVE-2021-20232)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4451 advisory.

    - Backport CVE-2021-3580 from upstream 3.7.3 release (#1967990)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4451 advisory.

    The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements     cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

    Nettle is a cryptographic library that is designed to fit easily in almost any context: In crypto toolkits     for object-oriented languages, such as C++, Python, or Pike, in applications like LSH or GNUPG, or even in     kernel space.

    The following packages have been upgraded to a later upstream version: gnutls (3.6.16). (BZ#1956783)

    Security Fix(es):

    * nettle: Remote crash in RSA decryption via manipulated ciphertext (CVE-2021-3580)

    * gnutls: Use after free in client key_share extension (CVE-2021-20231)

    * gnutls: Use after free in client_send_params in lib/ext/pre_shared_key.c (CVE-2021-20232)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4451 advisory.

  - gnutls: Use after free in client key_share extension (CVE-2021-20231)

  - gnutls: Use after free in client_send_params in lib/ext/pre_shared_key.c (CVE-2021-20232)

  - nettle: Remote crash in RSA decryption via manipulated ciphertext (CVE-2021-3580)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to     memory corruption and other consequences. (CVE-2021-20231)

  - A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may     lead to memory corruption and other potential consequences. (CVE-2021-20232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in gnutls. A use after free issue in     client sending key_share extension may lead to memory     corruption and other consequences.(CVE-2021-20231)

  - A flaw was found in gnutls. A use after free issue in     client_send_params in lib/ext/pre_shared_key.c may lead     to memory corruption and other potential     consequences.(CVE-2021-20232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5029-1 advisory.

    It was discovered that GnuTLS incorrectly handled sending certain extensions when being used as a client.
    A remote attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or     possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the gnutls packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in gnutls. A use after free issue in     client_send_params in lib/ext/pre_shared_key.c may lead     to memory corruption and other potential     consequences.(CVE-2021-20232)

  - A flaw was found in gnutls. A use after free issue in     client sending key_share extension may lead to memory     corruption and other consequences.(CVE-2021-20231)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the gnutls package has been released.

This update for gnutls fixes the following issues :

CVE-2021-20232: Fixed a use after free issue which could have led to memory corruption and other potential consequences (bsc#1183456).

CVE-2021-20231: Fixed a use after free issue which could have led to memory corruption and other potential consequences (bsc#1183457).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gnutls fixes the following issues :

  - CVE-2021-20232: Fixed a use after free issue which could     have led to memory corruption and other potential     consequences (bsc#1183456).

  - CVE-2021-20231: Fixed a use after free issue which could     have led to memory corruption and other potential     consequences (bsc#1183457).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

ID	Name	Product	Family	Severity
236730	Alibaba Cloud Linux 3 : 0181: gnutls (ALINUX3-SA-2022:0181)	Nessus	Alibaba Cloud Linux Local Security Checks	critical
187367	NewStart CGSL MAIN 6.06 : gnutls Multiple Vulnerabilities (NS-SA-2023-0100)	Nessus	NewStart CGSL Local Security Checks	critical
167470	NewStart CGSL MAIN 6.02 : nettle Multiple Vulnerabilities (NS-SA-2022-0091)	Nessus	NewStart CGSL Local Security Checks	critical
167469	NewStart CGSL MAIN 6.02 : gnutls Multiple Vulnerabilities (NS-SA-2022-0097)	Nessus	NewStart CGSL Local Security Checks	critical
164488	Rocky Linux 8 : gnutls and nettle (RLSA-2021:4451)	Nessus	Rocky Linux Local Security Checks	critical
159015	Oracle Linux 8 : gnutls (ELSA-2022-9221)	Nessus	Oracle Linux Local Security Checks	critical
157978	EulerOS Virtualization 3.0.6.0 : gnutls (EulerOS-SA-2022-1067)	Nessus	Huawei Local Security Checks	critical
157640	AlmaLinux 8 : gnutls and nettle (ALSA-2021:4451)	Nessus	Alma Linux Local Security Checks	critical
155423	Oracle Linux 8 : gnutls / and / nettle (ELSA-2021-4451)	Nessus	Oracle Linux Local Security Checks	critical
155114	RHEL 8 : gnutls and nettle (RHSA-2021:4451)	Nessus	Red Hat Local Security Checks	critical
155052	CentOS 8 : gnutls and nettle (CESA-2021:4451)	Nessus	CentOS Local Security Checks	critical
154807	EulerOS 2.0 SP8 : gnutls (EulerOS-SA-2021-2632)	Nessus	Huawei Local Security Checks	critical
152339	EulerOS 2.0 SP9 : gnutls (EulerOS-SA-2021-2271)	Nessus	Huawei Local Security Checks	critical
152302	EulerOS 2.0 SP9 : gnutls (EulerOS-SA-2021-2245)	Nessus	Huawei Local Security Checks	critical
152181	Ubuntu 20.04 LTS : GnuTLS vulnerabilities (USN-5029-1)	Nessus	Ubuntu Local Security Checks	critical
151553	EulerOS Virtualization 2.9.0 : gnutls (EulerOS-SA-2021-2204)	Nessus	Huawei Local Security Checks	critical
151548	EulerOS Virtualization 2.9.1 : gnutls (EulerOS-SA-2021-2184)	Nessus	Huawei Local Security Checks	critical
150236	Photon OS 4.0: Gnutls PHSA-2021-4.0-0035	Nessus	PhotonOS Local Security Checks	critical
150069	Photon OS 2.0: Gnutls PHSA-2021-2.0-0349	Nessus	PhotonOS Local Security Checks	critical
149949	Photon OS 1.0: Gnutls PHSA-2021-1.0-0391	Nessus	PhotonOS Local Security Checks	critical
149944	Photon OS 3.0: Gnutls PHSA-2021-3.0-0241	Nessus	PhotonOS Local Security Checks	critical
148171	SUSE SLED15 / SLES15 Security Update : gnutls (SUSE-SU-2021:0935-1)	Nessus	SuSE Local Security Checks	critical
148165	SUSE SLES15 Security Update : gnutls (SUSE-SU-2021:0934-1)	Nessus	SuSE Local Security Checks	critical
148148	openSUSE Security Update : gnutls (openSUSE-2021-470)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2021-20232

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical