This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-11501 →

DEBIAN-CVE-2020-11501

GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-...

Original description

The description as published by the source.

GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\0' bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 gnutls28

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.13-2"}]}]

Debian:13 gnutls28

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.13-2"}]}]

Debian:14 gnutls28

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.13-2"}]}]

References

advisory security-tracker.debian.org