Advisories ยป MGASA-2020-0379

Updated gnutls packages fix security vulnerability

Publication date: 30 Sep 2020
Type: security
Affected Mageia releases : 7
CVE: CVE-2020-24659


An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL
pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent
with unexpected timing, and then an invalid second handshake occurs. The crash
happens in the application's error handling path, where the gnutls_deinit
function is called after detecting a handshake failure (CVE-2020-24659).