An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2020-09-04T14:03:36
Updated: 2024-08-04T15:19:08.542Z
Reserved: 2020-08-26T00:00:00
Link: CVE-2020-24659
Vulnrichment
No data.
NVD
Status : Modified
Published: 2020-09-04T15:15:10.803
Modified: 2024-11-21T05:15:26.003
Link: CVE-2020-24659
Redhat