Uninitialized Pointer Access in gnutls
Summary
CVE-2019-3836: It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages. Affects gnutls across 2 version ranges.
< 3.6.7-r0
>= c87f22eec1b412aaafa873ff81b02f52532bfa79, < 2a40a3d90df001c520ab5f25f97608f5eb3c489e
Fixed in 3.6.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GnuTLS is an open-source library that provides secure communication over a network. It implements the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols, allowing applications to establish encrypted connections. The library is widely used in various software applications and systems.
Vulnerability Detail
The vulnerability, identified as CVE-2019-3836, exists in gnutls versions 3.6.3 or later. It is caused by an uninitialized pointer access in the library, which can be triggered by certain post-handshake messages. An attacker can exploit this vulnerability to execute arbitrary code or cause a denial-of-service (DoS) condition, potentially compromising the security and stability of the affected system.
How To Fix
Minimum fixed version
3.6.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade gnutlsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of gnutls to mitigate the risk effectively.
Conclusion
The uninitialized pointer access vulnerability in gnutls can have severe consequences, including arbitrary code execution and DoS attacks. It is crucial to update to the fixed version of gnutls (3.6.7 or later) to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gnutls →
FAQ
GnuTLS is an open-source library that provides secure communication over a network. It implements the TLS and SSL protocols.
The vulnerability can allow an attacker to execute arbitrary code or cause a DoS condition.
Versions 3.6.3 and later are affected by this vulnerability.
To fix this vulnerability, update gnutls to version 3.6.7 or later.
No, there is no known workaround for this vulnerability. Updating to the fixed version is necessary.
Related vulnerabilities
Recent vulnerabilities recorded for gnutls.
