CVE-2019-3829

A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected.

Score

CVSS 3.0 7.5 High

Status

Modified - secalert@redhat.com

Published

2019-03-27

Last modified

2024-08-04

Weaknesses

CWE-415, CWE-416

Affected products

• Fedora (Fedoraproject)
• Gnutls (Gnu)
• Gnutls (Gnutls)

References

• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00017.html
• https://access.redhat.com/errata/RHSA-2019:3600
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3829
• https://gitlab.com/gnutls/gnutls/issues/694
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A3ETBUFBB4G7AITAOUYPGX…
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7TJIBRJWGWSH6XIO2MXIQ…
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WRSOL66LHP4SD3Y2ECJDOG…
• https://security.gentoo.org/glsa/201904-14
• https://security.netapp.com/advisory/ntap-20190619-0004/
• https://usn.ubuntu.com/3999-1/
• https://www.gnutls.org/security-new.html#GNUTLS-SA-2019-03-27