Critical Vulnerability in GnuTLS: Application Crash via Malicious PEM Bundle
Summary
ALPINE-CVE-2024-28835: A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command. Affects gnutls versions < 3.8.4-r0. Fixed in 3.8.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GnuTLS is a secure communications library implementing the SSL, TLS, and DTLS protocols. It provides a robust framework for secure data transmission over networks, supporting various cryptographic algorithms and protocols. However, a recent vulnerability has been identified that can lead to application crashes when verifying specially crafted PEM bundles, impacting the reliability and security of applications utilizing GnuTLS.
Vulnerability Detail
A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the 'certtool --verify-chain' command. This vulnerability, identified as ALPINE-CVE-2024-28835, can potentially allow attackers to disrupt services and exploit the affected applications, leading to denial of service or further security breaches.
How To Fix
Minimum fixed version
3.8.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade gnutlsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'certtool --verify-chain' command with untrusted or unknown PEM bundles until the package is updated to a secure version.
Conclusion
The vulnerability identified in GnuTLS poses a significant risk to applications relying on this library for secure communications. It is crucial to update to the latest patched versions to mitigate the risk of application crashes and potential exploitation. Regular monitoring and updates are essential for maintaining security in open-source software.
See every vulnerability recorded for gnutls →
FAQ
GnuTLS is a secure communications library that provides support for SSL, TLS, and DTLS protocols, enabling secure data transmission over networks.
This vulnerability allows an application to crash when verifying specially crafted PEM bundles, potentially leading to service disruptions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without requiring any signup.
The consequences include potential denial of service and exploitation of affected applications, which can compromise security and reliability.
To update GnuTLS, use the command 'apk add gnutls@<version>' where <version> is the patched version for your Alpine Linux distribution.
References
Related vulnerabilities
Recent vulnerabilities recorded for gnutls.
