Critical Memory Corruption Vulnerability in GnuTLS - CVE-2021-20232
Summary
ALPINE-CVE-2021-20232: A flaw was found in gnutls. Affects gnutls versions < 3.6.15-r1. Fixed in 3.6.15-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GnuTLS is a secure communications library implementing the SSL, TLS, and DTLS protocols. It provides cryptographic functions and is widely used in various applications to ensure secure data transmission. The library is designed to facilitate secure communication over networks, making it a critical component in many software systems. However, it is susceptible to vulnerabilities that can compromise its security, such as the one identified in CVE-2021-20232.
Vulnerability Detail
A flaw was found in GnuTLS, specifically a use-after-free issue in the client_send_params function located in lib/ext/pre_shared_key.c. This vulnerability can lead to memory corruption, which may allow an attacker to execute arbitrary code, potentially compromising the confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS score of 9.8, indicating its critical nature and the severe impact it can have on systems utilizing GnuTLS.
How To Fix
Minimum fixed version
3.6.15-r1
This is the first release that contains the fix.
sudo apk add --upgrade gnutlsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider disabling the use of pre-shared keys in your application until the update can be applied. This can be done by modifying the configuration settings of your application to avoid using this feature.
Conclusion
CVE-2021-20232 is a critical vulnerability in GnuTLS that poses significant risks to applications relying on this library for secure communications. It is crucial to update to the patched versions to mitigate the risk of exploitation. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for gnutls →
FAQ
CVE-2021-20232 is a critical vulnerability in GnuTLS that can lead to memory corruption due to a use-after-free issue.
This vulnerability can allow attackers to execute arbitrary code, potentially compromising the security of your application and the data it handles.
The CVSS score for CVE-2021-20232 is 9.8, indicating a critical level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update GnuTLS immediately, consider disabling the use of pre-shared keys in your application as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for gnutls.
