CVE-2019-3836

It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages.

Score

CVSS 3.0 7.5 High

Status

Modified - secalert@redhat.com

Published

2019-04-01

Last modified

2024-08-04

Weaknesses

CWE-456, CWE-824

Affected products

• Fedora (Fedoraproject)
• Gnutls (Gnu)
• Gnutls (Gnutls)
• Leap (Opensuse)

References

• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00017.html
• https://access.redhat.com/errata/RHSA-2019:3600
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3836
• https://gitlab.com/gnutls/gnutls/issues/704
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A3ETBUFBB4G7AITAOUYPGX…
• https://security.gentoo.org/glsa/201904-14
• https://security.netapp.com/advisory/ntap-20190502-0005/
• https://usn.ubuntu.com/3999-1/