GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\0' bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol.
Fix
Patch, vendor advisory and mitigation references on NVD 6
- https://gitlab.com/gnutls/gnutls/-/commit/5b595e8e52653f6c5726a4cdd8fddeb6e83804d2 Patch, Third Party Advisory
- https://gitlab.com/gnutls/gnutls/-/issues/960 Issue Tracking, Patch, Third Party Advisory
- https://www.gnutls.org/security-new.html#GNUTLS-SA-2020-03-31 Vendor Advisory
- https://gitlab.com/gnutls/gnutls/-/commit/5b595e8e52653f6c5726a4cdd8fddeb6e83804d2 Patch, Third Party Advisory
- https://gitlab.com/gnutls/gnutls/-/issues/960 Issue Tracking, Patch, Third Party Advisory
- https://www.gnutls.org/security-new.html#GNUTLS-SA-2020-03-31 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.4 · gnu, canonical, debianNVD modified 2026-10-14 09:17
Affected (CPE criteria) 6
cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
References 21
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00015.html Third Party Advisory
- https://gitlab.com/gnutls/gnutls/-/commit/5b595e8e52653f6c5726a4cdd8fddeb6e83804d2 Patch, Third Party Advisory
- https://gitlab.com/gnutls/gnutls/-/issues/960 Issue Tracking, Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDYY3R4F5CUTFAMXH2C5NKYFVDEJLTT7/
- https://security.gentoo.org/glsa/202004-06 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200416-0002/ Third Party Advisory
- https://usn.ubuntu.com/4322-1/ Third Party Advisory
- https://www.debian.org/security/2020/dsa-4652 Third Party Advisory
- https://www.gnutls.org/security-new.html#GNUTLS-SA-2020-03-31 Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00015.html Third Party Advisory
- https://gitlab.com/gnutls/gnutls/-/commit/5b595e8e52653f6c5726a4cdd8fddeb6e83804d2 Patch, Third Party Advisory
- https://gitlab.com/gnutls/gnutls/-/issues/960 Issue Tracking, Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDYY3R4F5CUTFAMXH2C5NKYFVDEJLTT7/
- https://security.gentoo.org/glsa/202004-06 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200416-0002/ Third Party Advisory
- https://usn.ubuntu.com/4322-1/ Third Party Advisory
- https://www.debian.org/security/2020/dsa-4652 Third Party Advisory
- https://www.gnutls.org/security-new.html#GNUTLS-SA-2020-03-31 Vendor Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html