CVE-2024-0567
Gnutls: rejects certificate chain with distributed trust
Severity Score
Exploit Likelihood
Affected Versions
5Public Exploits
2Exploited in Wild
-Decision
Descriptions
A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.
Se encontró una vulnerabilidad en GnuTLS, donde una cabina (que usa gnuTLS) rechaza una cadena de certificados con confianza distribuida. Este problema ocurre al validar una cadena de certificados con cockpit-certificate-ensure. Este fallo permite que un cliente o atacante remoto no autenticado inicie un ataque de denegación de servicio.
It was discovered that GnuTLS had a timing side-channel when processing malformed ciphertexts in RSA-PSK ClientKeyExchange. A remote attacker could possibly use this issue to recover sensitive information. It was discovered that GnuTLS incorrectly handled certain certificate chains with a cross-signing loop. A remote attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2024-01-16 CVE Reserved
- 2024-01-16 CVE Published
- 2024-11-23 CVE Updated
- 2024-11-23 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-347: Improper Verification of Cryptographic Signature
CAPEC
References (12)
| URL | Date | SRC |
|---|