IM
IronMonkey Threat Research

CVE-2024-0567 HIGH

Published: 2024-01-16 | Last Modified: 2024-11-21 | Status: Modified

Description

A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.

Additional Descriptions (1)

Se encontró una vulnerabilidad en GnuTLS, donde una cabina (que usa gnuTLS) rechaza una cadena de certificados con confianza distribuida. Este problema ocurre al validar una cadena de certificados con cockpit-certificate-ensure. Este fallo permite que un cliente o atacante remoto no autenticado inicie un ataque de denegación de servicio.

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-347
[email protected] Primary
en CWE-347

Affected Products

Vendor Product Version Update Type
gnu gnutls * <built-in method update of dict object at 0x7fd369ee9140> Application
fedoraproject fedora 38 <built-in method update of dict object at 0x7fd36a9ad580> Operating System
fedoraproject fedora 39 <built-in method update of dict object at 0x7fd368d805c0> Operating System
netapp active_iq_unified_manager - <built-in method update of dict object at 0x7fd2dbcaa200> Application
debian debian_linux 11.0 <built-in method update of dict object at 0x7fd369eeb0c0> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

References