SB20200407145 - Ubuntu update for gnutls28

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20200407145

SB20200407145 - Ubuntu update for gnutls28

Published: April 7, 2020 Updated: October 30, 2026

Security Bulletin ID SB20200407145
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Use of insufficiently random values (CVE-ID: CVE-2020-11501)

CWE-ID: CWE-330 - Use of Insufficiently Random Values

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to decrypt data.

The vulnerability exists in GnuTLS DTLS protocol implementation due to an error in code that caused DTLS client not to contribute any randomness to the DTLS negotiation. As a result a remote attacker with ability to intercept network traffic can decrypt data passed via TLS 1.3 connection and gain access to sensitive information.


Remediation

Install update from vendor's website.

References