Double free in GnuTLS - CVE-2019-3829

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU18107

Double free in GnuTLS - CVE-2019-3829

Published: April 1, 2019


Vulnerability identifier: #VU18107
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-3829
CWE-ID: CWE-415
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a double free error in the certificate verification API when processing X.509  crtificates. A remote attacker can supply a specially crafted X.509  certificate, trigger double free error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

GnuTLS
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
gnutls28 (Ubuntu package)
gnutls (Alpine package)
gnutls

How to mitigate CVE-2019-3829

Install updates from vendor's website.

GnuTLS - update to 3.6.7
gnutls28 (Ubuntu package) - addressed in versions 3.4.10-4ubuntu1.5, 3.5.18-1ubuntu1.1, 3.6.4-2ubuntu1.2, 3.6.5-2ubuntu1.1
gnutls (Alpine package) - addressed in versions 3.6.1-r0, 3.6.7-r0
gnutls - addressed in versions 3.6.5-3.fc28, 3.6.7-1.fc29, 3.6.7-1.fc30

External References

Related Security Bulletins