CVE-2020-13777
גבוהה 7.4
תיאור (מקור, אנגלית)
GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.
מדדים
- CVSS 3.1
-
7.4 (HIGH)
מקור הציון: NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - EPSS — סבירות ניצול
- 22% (אחוזון 100) נכון ל-18/10/2026
- CWE
- CWE-327
מוצרים מושפעים
gnu: gnutls; fedoraproject: fedora; canonical: ubuntu linux; debian: debian linux
קישורים
- https://gnutls.org/security-new.html#GNUTLS-SA-2020-06-03 Vendor Advisory
- https://gnutls.org/security-new.html#GNUTLS-SA-2020-06-03 Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00015.html Broken Link
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap…
- https://security.gentoo.org/glsa/202006-01 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200619-0004/ Third Party Advisory
- https://usn.ubuntu.com/4384-1/ Third Party Advisory