Use of insufficiently random values in GnuTLS - CVE-2020-11501
Published: March 31, 2020 / Updated: April 4, 2020
Vulnerability identifier: #VU26487
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2020-11501
CWE-ID: CWE-330
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: GnuTLS
Affected software:
GnuTLS
GnuTLS
Detailed vulnerability description
The vulnerability allows a remote attacker to decrypt data.
The vulnerability exists in GnuTLS DTLS protocol implementation due to an error in code that caused DTLS client not to contribute any randomness to the DTLS negotiation. As a result a remote attacker with ability to intercept network traffic can decrypt data passed via TLS 1.3 connection and gain access to sensitive information.
How to mitigate CVE-2020-11501
Install updates from vendor's website.